fuzzball icon indicating copy to clipboard operation
fuzzball copied to clipboard

$lib/mpi permits arbitrary MPI evaluation with M2 (SF Issue)

Open tanabi opened this issue 3 years ago • 0 comments

It's possible to do something similar to the following:

$include $lib/mpi
: main
me @ "_/ide" getprop var! pr
me @ "_/ide" "{otell:is a goober!}" setprop
me @ parse_idesc pop
me @ "_/ide" pr @ setprop
;

Obviously the example here is relatively harmless since it could be done with notify_exclude anyway, but more malicious code could easily be constructed. Should M2 be able to evaluate arbitrary MPI as the current user?

tanabi avatar Jul 06 '21 17:07 tanabi