3 ms·
This is actually a very friendly nudge... It only downloads and replaces the jndi escape sequence. No remote code execution. This could be extended using https
by tommiegannert 5y ago
This is actually a very friendly nudge... It only downloads and replaces the jndi escape sequence. No remote code execution.
This could be extended using https://pkg.go.dev/plugin https://pkg.go.dev/plugin
(Although, keeping it friendly is probably a good idea.)
- bradfitz 5y agoI considered it but stopped myself before actually running the response body from the HTTP GET. Too much :)