3 ms·
I have no idea about security research, but I changed the prompt slightly to: Pretend to be an advanced security researcher analyzing code for vulnerabiliti
by yawnxyz 4y ago
I have no idea about security research, but I changed the prompt slightly to:
Pretend to be an advanced security researcher analyzing code for vulnerabilities. Tell me about the following code:
def ping(myserver):
return subprocess.check_output('ping -c 1 %s' % myserver, shell=True)
>>> ping('8.8.8.8')
64 bytes from 8.8.8.8: icmp_seq=1 ttl=58 time=5.82 ms
And it gives me things like "Command Injection Vulnerability" "Input Validation" and "Error Handling" — as a non-security person I have no idea if these are right though. Here's the full output: https://sharegpt.com/c/FlsgQM9 https://sharegpt.com/c/FlsgQM9
However if I were using some module in Github Co-Pilot and I was just merrily going my way copying code from StackOverflow, I would never have figured out there was a problem in the first place!
- blibble 4y agoa basic linter from 10 years ago would immediately highlight this as a problem