2 ms·
In Ruby it can easily be used to submit malicious source code to a repository (for example the reviewers thinking that a variable is set to some value, when in
by xiphias2 8y ago
In Ruby it can easily be used to submit malicious source code to a repository (for example the reviewers thinking that a variable is set to some value, when in fact a new variable is created).
- heartbreak 8y agoAn attacker would still have to _do_ something with their new maliciously named constant, which would be as noticeable as any other malicious contribution. This is grasping at straws.
- rileymat2 8y agoThis is probably pretty overblown, but if a function takes a flag, it would be possible to pass in a different value to the function than appears to be passed in at first glance.
- xiphias2 8y agoNot really, just thinking that an operation changes a variable when it in fact doesn't is enough to introduce a security vulnerability.