Questions about this topic? Sign up to ask in the talk tab.

Unsafe evaluation

From NetSec
Jump to: navigation, search
   Unsafe evaluation

Proof of concept:

  • It is never safe to eval() user input, plain and simple. There is always another way to skin the cat; try and consider that!

Mitigation:

  • Design around the need to combine the function "eval" with user input.


Auditing:

IGNORECASE=1 find -regextype posix-awk -regex ".*\.(rb|php|pl|py|pm)" -exec grep -HnC2 \\beval\( '{}' \;