Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactored ghunt.py #385

Closed
wants to merge 1 commit into from
Closed

Refactored ghunt.py #385

wants to merge 1 commit into from

Conversation

lil-skelly
Copy link

Cleaned the ghunt.py file

This was done by removing the nested if else statements and replacing them with a dynamic function call using the eval() builtin.

@mxrch
Copy link
Owner

mxrch commented Nov 27, 2022

Hello ! The use of the eval() function adds nothing but a vulnerability, by executing code given in the user input. It's a big no.

@mxrch mxrch closed this Nov 27, 2022
@lil-skelly
Copy link
Author

Well in this case you cant abuse it in any way. But either way, this is a general design issue with the script. There should be a validation system, and not random len checks. I will implement this now, and open a new pr.
-ps I didnt notice that there wasnt a input validation.

@mxrch
Copy link
Owner

mxrch commented Nov 27, 2022

@CopernicusPY No need for a new PR, I will just not implement a "dynamic" function with eval. It's dirty, and needs extra protection to protect it from injections.

@mxrch
Copy link
Owner

mxrch commented Nov 27, 2022

Well in this case you cant abuse it in any way

You can abuse it.

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants