|
|
|
|
|
by Terr_
946 days ago
|
|
That's like a now-defunct startup I worked for early in my career. Their custom scripting language worked by eval()ing code to get a string, searching for special delimiters inside the string, and eval()ing everything inside those delimiters, iterating the process forever until no more delimiters were showing up. As you can imagine, this was somewhat insane, and decent security depended on escaping user input and anything that might ever be created from user input everywhere for all time. In my youthful exuberance, I should have expected the CEO would not be very pleased when I demonstrated I could cause their website search box to print out the current time and date. |
|