2 ms·

This is such a massive footgun wow...

• chii 5y ago
  it's not any different from eval() tbh - the onus is on the programmer to not trust input. The problem is when libraries do unexpected things, like the log4j RCE.