Questions about this topic? Sign up to ask in the talk tab.
Difference between revisions of "Unsafe evaluation"
From NetSec
| Line 1: | Line 1: | ||
| − | + | =Proof of concept= | |
| − | Proof of concept | + | |
| − | + | It is never safe to eval() user input, plain and simple. There is always another way to skin the cat; try and consider that! | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| + | =Mitigation= | ||
| + | |||
| + | Design around the need to combine the function "eval" with user input. | ||
| + | |||
Auditing: | Auditing: | ||
{{code|text=<source lang="bash">IGNORECASE=1 find -regextype posix-awk -regex ".*\.(rb|php|pl|py|pm)" -exec grep -HnC2 \\beval\( '{}' \;</source>}} | {{code|text=<source lang="bash">IGNORECASE=1 find -regextype posix-awk -regex ".*\.(rb|php|pl|py|pm)" -exec grep -HnC2 \\beval\( '{}' \;</source>}} | ||
[[Category:Secure programming]] | [[Category:Secure programming]] | ||
Revision as of 01:56, 12 May 2013
Proof of concept
It is never safe to eval() user input, plain and simple. There is always another way to skin the cat; try and consider that!
Mitigation
Design around the need to combine the function "eval" with user input.
Auditing:
IGNORECASE=1 find -regextype posix-awk -regex ".*\.(rb|php|pl|py|pm)" -exec grep -HnC2 \\beval\( '{}' \; |
