Questions about this topic? Sign up to ask in the talk tab.
Unsafe evaluation
From NetSec
Proof of concept
It is never safe to eval() user input, plain and simple. There is always another way to skin the cat; try and consider that!
Mitigation
Design around the need to combine the function "eval" with user input.
Auditing:
IGNORECASE=1 find -regextype posix-awk -regex ".*\.(rb|php|pl|py|pm)" -exec grep -HnC2 \\beval\( '{}' \; |
