4 ms·

TL;DR: obj[key] with user-controlled key == "proto" is a gift that keeps on giving; buy our AI tool that will write subtle vulnerabilities like that which y

TL;DR: obj[key] with user-controlled key == "__proto__" is a gift that keeps on giving; buy our AI tool that will write subtle vulnerabilities like that which you yourself won’t catch in review but then it will also write some property-based tests that maybe will

fireflash38 10mo ago
Don't forget you can use AI to turn a 50 word blog post into a 2,000 word one!
- mirthturtle 10mo ago
  For real. The bullet-point summary at the beginning with a "Why this matters for..." immediately followed by, "This isn't just a theoretical exercise—it's a real example of..." Dead giveaways.
- raphting 10mo ago
  Exactly this! AI fluff all over in that article.
  - latentsea 10mo ago
    You're absolutely right!
nslog 10mo ago
Didn't react just have basically the same vuln
- mananaysiempre 10mo ago
  The code in TFA is, by a hair’s breadth, not actually vulnerable, as long as the type signature of the function is obeyed. React spinned the same gun in the game of Russian roulette but was less lucky.
toobulkeh 10mo ago
It also talks about using PBT and Randomness for some reason. This is clearly just a test value of a non-AI library written by a human. My take away is “don’t write your own input tests, use a library”. The rest is AI-slip
- mananaysiempre 10mo ago
  Theoretically a good fuzzer could discover this value by itself, but I don’t believe anything like that exists that could run JS code and explore VM-level branches, at least not for JS code that’s even this complex. Otherwise, yes, PBT is less trivial than it seems, though I’m guessing a simple `strings jsc` coupled with general knowledge of special values of other types[1,2] could get you quite far. [1] https://www.exploringbinary.com/php-hangs-on-numeric-value-2-2250738585072011e-308/ https://www.exploringbinary.com/php-hangs-on-numeric-value-2... [2] https://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/ https://www.exploringbinary.com/java-hangs-when-converting-2...

TL;DR: obj[key] with user-controlled key == "__proto__" is a gift that keeps on giving; buy our AI tool that will write subtle vulnerabilities like that which y

fireflash38 10mo ago

Don't forget you can use AI to turn a 50 word blog post into a 2,000 word one!

mirthturtle 10mo ago
For real. The bullet-point summary at the beginning with a "Why this matters for..." immediately followed by, "This isn't just a theoretical exercise—it's a real example of..." Dead giveaways.
raphting 10mo ago
Exactly this! AI fluff all over in that article.
- latentsea 10mo ago
  You're absolutely right!

nslog 10mo ago

Didn't react just have basically the same vuln

mananaysiempre 10mo ago
The code in TFA is, by a hair’s breadth, not actually vulnerable, as long as the type signature of the function is obeyed. React spinned the same gun in the game of Russian roulette but was less lucky.

toobulkeh 10mo ago

It also talks about using PBT and Randomness for some reason. This is clearly just a test value of a non-AI library written by a human. My take away is “don’t write your own input tests, use a library”. The rest is AI-slip

mananaysiempre 10mo ago
Theoretically a good fuzzer could discover this value by itself, but I don’t believe anything like that exists that could run JS code and explore VM-level branches, at least not for JS code that’s even this complex. Otherwise, yes, PBT is less trivial than it seems, though I’m guessing a simple `strings jsc` coupled with general knowledge of special values of other types[1,2] could get you quite far. [1] https://www.exploringbinary.com/php-hangs-on-numeric-value-2-2250738585072011e-308/ https://www.exploringbinary.com/php-hangs-on-numeric-value-2... [2] https://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/ https://www.exploringbinary.com/java-hangs-when-converting-2...