Re: Vulnerabilities when editing untrusted code... (Komodo)

Replies are listed 'Best First'.
Re^2: Vulnerabilities when editing untrusted code... (compiletime injection in regex) by LanX (Saint) on Oct 06, 2021 at 14:46 UTC
looks like this has been taken care of! `D:\tmp\pm>type unsafe_regex_BEGIN.pl exit; '' =~ ('(?{B'.'EGIN{die "owned"}})'); D:\tmp\pm>perl -c unsafe_regex_BEGIN.pl Eval-group not allowed at runtime, use re 'eval' in regex m/(?{BEGIN{d +ie "owned" }})/ at unsafe_regex_BEGIN.pl line 3. D:\tmp\pm>perl -v This is perl 5, version 32, subversion 1 (v5.32.1) built for MSWin32-x +64-multi-thread` [download] Tho I don't understand the message. Why "runtime"??? update found this https://github.com/rurban/perl-compiler/issues/137 and mailed Reini asking for insight. :) Cheers Rolf _{(addicted to the Perl Programming Language :) Wikisyntax for the Monastery}	[reply] [d/l]
Re^3: Vulnerabilities when editing untrusted code... (compiletime injection in regex) by LanX (Saint) on Oct 06, 2021 at 15:24 UTC
OK the term "eval-group" seems to refer to an optimization which concats 2 strings ° `'' =~ ('STRING1'.'STRING2');` but if you don't bother splitting up the `BEGIN` you can still inject code at compiletime :( `D:\tmp\pm>type unsafe_regex_BEGIN.pl exit; '' =~ m/(?{ BEGIN{ die "owned"} })/ ; D:\tmp\pm>perl -c unsafe_regex_BEGIN.pl owned at unsafe_regex_BEGIN.pl line 2. BEGIN failed--compilation aborted at unsafe_regex_BEGIN.pl line 2. D:\tmp\pm>` [download] Cheers Rolf _{(addicted to the Perl Programming Language :) Wikisyntax for the Monastery} °) and variable interpolation in general see re#'eval'-mode	[reply] [d/l] [select]
Re^2: Vulnerabilities when editing untrusted code... (Komodo) by LanX (Saint) on Jul 01, 2010 at 11:05 UTC
~~Really???~~ `lanx@nc10-ubuntu:~$ cat >/tmp/tst.pl exit; ''=~('(?{B'.'EGIN{print "owned\n"}})') lanx@nc10-ubuntu:~$ perl /tmp/tst.pl owned lanx@nc10-ubuntu:~$ perl -c /tmp/tst.pl /tmp/tst.pl syntax OK` [download] ~~A syntax check doesn't execute your code!~~ UPDATE: corrected test: `lanx@nc10-ubuntu:/tmp$ cat >tst.pl exit; ''=~('(?{B'.'EGIN{print "owned"}})') lanx@nc10-ubuntu:/tmp$ cat tst.pl exit; ''=~('(?{B'.'EGIN{print "owned"}})') lanx@nc10-ubuntu:/tmp$ perl -c tst.pl tst.pl syntax OK ownedlanx@nc10-ubuntu:/tmp$` [download] WOW! 8( Cheers Rolf	[reply] [d/l] [select]
Re^3: Vulnerabilities when editing untrusted code... (Komodo) by Fox (Pilgrim) on Jul 01, 2010 at 11:59 UTC
well, it actually executes for me: $ perl -c tst.pl owned tst.pl syntax OK $ perl -MO=Deparse tst.pl owned exit; '' =~ /(?{BEGIN{print "owned\n"}})/; tst.pl syntax OK $ perl --version This is perl, v5.10.0 built for x86_64-linux-gnu-thread-multi Copyright 1987-2007, Larry Wall Perl may be copied only under the terms of either the Artistic License + or the GNU General Public License, which may be found in the Perl 5 source ki +t. Complete documentation for Perl, including FAQ lists, should be found +on this system using "man perl" or "perldoc perl". If you have access to + the Internet, point your browser at http://www.perl.org/, the Perl Home Pa +ge. $ [download]	[reply] [d/l]
Re^4: Vulnerabilities when editing untrusted code... (Komodo) by LanX (Saint) on Jul 01, 2010 at 12:21 UTC
Thanks! my fault, apparently I oversaw the "owend" text before the prompt. Thats REALLY strange... 8( Cheers Rolf	[reply]

update