Polyscripting scrambles programming languages to prevent code injection

Re:Polyscripting scrambles programming languages to prevent ... by duckerude on Friday July 06, 2018 @02:22PM (#17473875)

> Within the tests/evalExploit directory, there is a php file that runs eval() on user input, a common code-injection vulnerability, to experience the power of Polyscripting.

What happens if you eval "`rm -rf /*`;" or "`grep root /etc/passwd`;"? Does it scramble backticks?

[ Parent | on HN ]

Re:Polyscripting scrambles programming languages to prevent ... by notveryrational on Saturday July 07, 2018 @09:57AM (#17478509)

I doubt it scrambles backticks. In its example on the webpage it just creates a keywork scrambler. The grammar is intact with most of the lexing.

[ Parent | on HN ]

Re:Polyscripting scrambles programming languages to prevent ... by maxk42 on Friday July 06, 2018 @04:20PM (#17474800)

It claims to modify the AST, so yes, hypothetically, it would scramble backticks.

Note that I have not reviewed the code -- I'm only going by the claims in the article.

[ Parent | on HN ]