3 ms·
Because it's just in general incredibly short sighted to think that your config file is never going to be read by code written in another language. There's als
by zmmmmm 8y ago
Because it's just in general incredibly short sighted to think that your config file is never going to be read by code written in another language.
There's also an argument about whether making configuration files able to execute arbitrary code is a good idea. You get straight into the JavaScript 'eval' problems which we've spent a decade escaping.
- dcbadacd 8y agoArbitrary code execution in configuration files has caused a few vulnerabilities in Wordpress extensions already, so yes, it's a terrible idea.