12 ms·
It's somewhat refreshing that the underlying bug isn't from some C or C++ utility, but instead a Perl program using eval: https://github.com/exiftool/exiftool/b
by Jach 5y ago
It's somewhat refreshing that the underlying bug isn't from some C or C++ utility, but instead a Perl program using eval: https://github.com/exiftool/exiftool/blob/11.70/lib/Image/ExifTool/DjVu.pm#L233 https://github.com/exiftool/exiftool/blob/11.70/lib/Image/Ex... Another instance of "avoid eval as much as possible" for languages that have it.
- xxpor 5y agoWith dlopen() and libclang/libgccjit, you could argue C (on an OS that supports dynamic loading) has eval too ;)
- ed25519FUUU 5y agoPublic facing? Handles user input data?? Uses ‘eval’???
- Gigachad 5y agoThe line existed in the 2014 commit which migrated the repo to git. It wasn't designed in the current era of mass automated abuse and internet connected everything.
- majou 5y ago2014 was very much that era, I'd accept this excuse maybe for 2007
- kibwen 5y agoThe line wasn't written in 2014, that's just the earliest that the history goes back. Presumably it's no newer than the early 2000s.
- Gigachad 5y agoConsidering that initial commit contains 400k lines, I would say there is a very long history before git was used.
- danudey 5y agoI remember before 2007 seeing people using eval and thinking "what on earth is wrong with you?" I'd accept this for maybe pre-2000, but people should really know better.
- leejo 5y agoThe comment in the code slightly above says: this doesn't work in perl 5.6.2! grrrr So this code is at least 20 years old, and probably pre-2000.
- sebcat 5y ago
- winrid 5y agoMy personal career favorite use of eval was for an import system that "unrolled" the loop that went through the columns for each row, using eval. It was much faster, but obviously a huge security risk. Today with modern JIT compilers its probably not much faster...
- rsj_hn 5y agoI saw a very similar thing with eval. There was an evaluation of a nested JSON object x["a"]["b"]["c"] And the developer decided that this was best evaluated by eval. During the code review phase I talked to them and asked why they were using eval, and they didn't know it could be evaluated directly as they were a little unclear if javascript supported that syntax.
- FpUser 5y ago>"avoid eval" We are already avoiding / trying to avoid way too much interesting and useful things. All for the sake of security and only to encounter new ways to be attacked. Instead of "avoid" how about actually organizing worldwide intolerance and hunt for those attackers.
- sedatk 5y ago> avoid eval as much as possible "eval is evil", if you will.
- beefield 5y agoOkay, I'll bite. I have known for a long time that eval is evil. Then, last year I actually needed to evaluate a string (from a file). As the case was safe enough (input 100% controlled by me), I did not worry too much and just used eval. But what would be a safe way to evaluate things if you needed to do that in unsafe environment? Say, you would like to make a safe website that allows user type a python code snippet and that would be evaluated/executed server side? Is that even possible?
- lemoncucumber 5y agoSure, that's basically what services like AWS Lambda do. As a starting point, you'd want to run the code in a short-lived VM with little to no network access which is dedicated to just running untrusted code.
- nl 5y agoThis is a bad solution. Lambda allows arbitraty network access and may allow access to your AWS resources. If you have to do this, the best approach is to containerise it, use capabilities to enforce restrictions and run in a virtual machine as isolated as possible. It's still not great though. Some languages (eg Java) have additional features that help with this though.
- lemoncucumber 5y agoYes, I was simplifying — the important part is keeping the untrusted code off of a trusted network. If you want to do the legwork of carefully segregating things then of course network access can work. I didn’t mention containers since they don’t provide strong isolation and some people misuse them as though they do. There’s no harm in using them as another layer of defense, but hardware virtualization provides much better security.
- PLG88 5y agoWhy not just not trust the network or host at all. Put private connectivity inside trusted code using an SDK. Then the trusted apps can only communicate to devices/apps defined and nothing else. Untrusted code cannot access the trusted network as the network is acutally inside the apps/system.