3 ms·
"We've found 99,841 code results" Someone should write a script that automatically raises an issues for each line and each project, it's probably possible, but
by catmanjan 12y ago
"We've found 99,841 code results"
Someone should write a script that automatically raises an issues for each line and each project, it's probably possible, but I'm chronically lazy.
- rplnt 12y agoAs noted in other comment(s), there are legit uses for this.
- ircmaxell 12y agoCan you please provide just one? No other comment does that. And to be clear, I'm talking about providing at least one legit use for passing user input directly to exec without any kind of filtering...
- scott_karana 12y agoThe sourcecode of a hypothetical Github commenting bot searching for this vulnerability will have the same search token, and will be flagged.
- andrewryno 12y agoA great example is: https://github.com/andresriancho/w3af-moth https://github.com/andresriancho/w3af-moth He deliberately wrote vulnerable code to test his auditing script. There are more repos like this.
- ircmaxell 12y agoThat's fair. But that's also the vast minority of these results that I can tell...
- TheCoelacanth 12y agoTest cases for a PHP vulnerability scanner[1] [1] https://news.ycombinator.com/item?id=7665232 https://news.ycombinator.com/item?id=7665232
- munimkazia 12y agoWell, some of them are false positives.
- monksy 12y agoI thought about doing the exact same thing. But I wonder about the: limiting of the issue creation API on github and false positives. [The variable has been sanitized prior to being executed]
- JelteF 12y agoI remember reading about something like this and Github their response was that the guy should stop according to their ToS. Their ToS blocks stuff like this to prevent spamming.
- tlrobinson 12y agoI don't like Issue bots, but it could actually be a huge value-add for GitHub to integrate these kinds of checks (as well as hardcoded credentials, etc) for their users.
- marlin 12y agoAfter looking at the search result i can see that most of the results have legit reasons. Instead of half-assing the problem, please dedicate 10 minute of your life to look in, analyze & report one or two of the problems you find. Also explain why you think this is an security issue. You will: * help someone out by pointing out an issue * hopefully educate the person how to write better code * educate yourself in reading and understanding others spaghetti code