4 ms·
it does if `rm -rf /var/www/fakecall.net/accounts/../../../../usr` actually hits /usr and mangles the server.
by uxp 15y ago
it does if `rm -rf /var/www/fakecall.net/accounts/../../../../usr` actually hits /usr and mangles the server.
- sliverstorm 15y agoThat would simply be poor system design. Why would you run the service and/or the rm's as root?
- burgerbrain 15y agoOk. You run the service/rm's as a user specially created user. So think about what happens when they do the above. Hint: not nothing. Or to put it more bluntly: What about `rm -rf /var/www/fakecall.net/accounts/../*`?
- sliverstorm 15y agoI understand what would happen, what I mean is this is a free service the guy is offering for fun. Does it really matter if all the accounts are deleted? I mean, it could be annoying, but I don't generally expect account protection on free side-project hobby services.
- burgerbrain 15y agoWell if we're looking at it like that, would it really matter if somebody did do a `rm -rf /` as root? I can't imagine it'd take him more than a few minutes to redeploy.
- vog 15y agoIn that case, either all data of all users is permanently destroyed, or they have backups in which case their "rm -rf" command is just a sham.
- GigabyteCoin 15y ago> Does it really matter if all the accounts are deleted? Yes. Who said it's going to be free forever?
- cjfont 15y agoIf you consider that the above example could be avoided with a single line of code, it does matter in the sense that he's avoiding a huge headache, not so much that he's offering any sort of guarantee to users.