Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Advanced Calculator]: Security #54

Closed
Airero opened this issue Jul 21, 2022 · 0 comments · Fixed by #56
Closed

[Advanced Calculator]: Security #54

Airero opened this issue Jul 21, 2022 · 0 comments · Fixed by #56
Labels
bug Something isn't working

Comments

@Airero
Copy link

Airero commented Jul 21, 2022

#48 中的问题并未完全解决

在命令!!calc item中,eval()的执行未经过滤。但由于参数分割及if len(ctx) == 1:的限制,使得形如!!calc item __import__("os").system("echo Hello!")含有空格的指令无法被eval()执行。但仍可通过字符拼接的方式成功执行:!!calc item __import__("os").system("echo+chr(32)+Hello!")

`

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants