fuzzball
fuzzball copied to clipboard
$lib/mpi permits arbitrary MPI evaluation with M2 (SF Issue)
It's possible to do something similar to the following:
$include $lib/mpi
: main
me @ "_/ide" getprop var! pr
me @ "_/ide" "{otell:is a goober!}" setprop
me @ parse_idesc pop
me @ "_/ide" pr @ setprop
;
Obviously the example here is relatively harmless since it could be done with notify_exclude anyway, but more malicious code could easily be constructed. Should M2 be able to evaluate arbitrary MPI as the current user?