[mintflow]

pure logic error, the undergoing tailscale rust rewrite can't help this too:)

[bestouff]

If it used one of the standard arguments-handling crates (e.g. "clap") there's no way it can happen.

[pferde]

If it used one of the standard system APIs for looking up user accounts (e.g. getpwnam(3)), there's no way it can happen.

This is incredibly bad engineering, on level of a SQL injection, in 21st century. Something a highschool student experimenting with scripting could come up with, but not a supposedly professional software company.

[bestouff]

Agreed.

[mintflow]

that said, the limit impact perhaps is only affected multiple users in tailnet if the ACL is not configure correctly

As single tailnet+single user, perhaps it's just okay