3 ms·
I get that part, but in what scenario will user input actually be provided to this package? It feels like this is highly unlikely and that there probably won't
by donkeyd 8y ago
I get that part, but in what scenario will user input actually be provided to this package? It feels like this is highly unlikely and that there probably won't be any cases where this will actually be an issue. I may be wrong though, I just can't think of anything.
- martinald 8y agoAn example off the top of my head would be some sort of IoT device which has a drop-down to communicate via 4G, WiFi, ethernet etc. I'd be they'd put the value of the select to be the interface name and wouldn't check input value, so you could craft a special request with a bad value. But I do agree; not super easy to exploit. The more worrying fact is something like this which could easily be drawn in to 100m installs.