3 ms·
What if you wrote something more like: # terrible code, never use ty def cleanup(dir): system("rm -rf {dir}") def main(): work_dir =
by staticassertion 8mo ago
What if you wrote something more like:
# terrible code, never use ty
def cleanup(dir):
system("rm -rf {dir}")
def main():
work_dir = os.env["WORK_DIR"]
cleanup(work_dir)
and then due to a misconfiguration "$WORK_DIR" was truncated to be just "/"?
At what point is it negligent?
- direwolf20 8mo agoThis is not hypothetical. Steam and Bumblebee did it.
- a_t48 8mo agoBungie, too, in a similar way.
- extraduder_ire 8mo agoThat was the result of an additional space in the path passed to rm, IIRC. Though rm /$TARGET where $TARGET is blank is a common enough footgun that --preserve-root exists and is default.
- niyikiza 8mo agoYou'd be surprised to see how often we're seeing those types of semantic attack vulnerabilities in Agent frameworks: https://niyikiza.com/posts/map-territory/ https://niyikiza.com/posts/map-territory/
- cyberax 8mo agoEven better, $TARGET might be "/home/user/documents and settings /bin"
- extraduder_ire 8mo agoI believe that is what staticassertion was suggesting. / is a poor example because of --preserve-root being the default.
- cyberax 8mo agoNot quite. The grandparent's example was missing quotes around $TARGET. Which is yet _another_ footgun. Without quotes it becomes: `rm -Rf /home/user/documents and settings /bin`
- extraduder_ire 8mo agoFound it. is was this line [0] specifically. "rm -rf /usr /lib/nvidia-current/xorg/xorg" instead of "rm -rf /usr/lib/nvidia-current/xorg/xorg", which will delete all of /usr and then fail to delete a non-existent directory at /lib/nvidia-current/xorg/xorg 0: https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/commit/a047be85247755cdbe0acce6f1dafc8beb84f2ac#diff-043df5bdbf6639d7a77e1d44c5226fd7371e5259a1e4df3a0dd5d64c30dca44fL351 https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/commi...