3 ms·
The developer has accounted for this with a prominent link to the file in question, see “View the script that will be executed here”.
by yunohn 4y ago
The developer has accounted for this with a prominent link to the file in question, see “View the script that will be executed here”.
- tslocum 4y agoThis actually doesn't protect you the way you think it does. Using a simple check of the user agent which makes the request, an innocuous file may be served to browser requests, while an infected file may be served to cURL requests.
- kej 4y agoYou can even get more devious and use timing differences to serve one thing to `curl` and a different thing to `curl | bash`: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...