3 ms·
Yea that's a good point. You really don't want to have someone else access your clarity installation. This takes URL parameters and runs them on the command lin
by xal 17y ago
Yea that's a good point. You really don't want to have someone else access your clarity installation. This takes URL parameters and runs them on the command line. Probably the most insecure thing invented by man. Hide it will.
- tptacek 17y agoNo, the most insecure things invented by people take URL parameters from unauthenticated requests and run them on the command line. I didn't audit the code or anything, but all the request processing is gated by a function that requires HTTP basic-auth, which is at least hard to screw up. To accidentally add a function that bypasses auth, they'd have to write an entire new request handler chain. That said, I noticed the same thing (popen), and if I was going to integrate this with our product, I'd hardcode the command line.
- erikb85 17y agoAbsolutely right. It is maybe not insecure in itself. But as we all know: More possibilities to get into the server increases the possibility for an attacker to find an open door. Maybe everybody who has the right to grep and tail should get ssh access anyway. But wether or not this App is useful: Nice implementation. Looks usable and gives clear output.