Re:Pear.php.net shuts down after maintainers discover seriou...
by acdha on Thursday January 24, 2019 @09:03AM
(#18988717)
> Thankfully nobody is using PEAR anymore
How many thousands of people are in that “nobody”? The places which have legacy baked in are probably also the least equipped to avoid it, too.
Grepping has commonly been evaded since at least the late 90s. lowercased pointed out the use of request values already. Other techniques include encoding a string or byte array and decoding it into a file, pipe, etc. Static analysis can catch some things but it’s fundamentally the halting problem unless you can apply very restrictive sandbox policies — no file I/O, whitelist a few lines which can do certain operations, etc.
How many thousands of people are in that “nobody”? The places which have legacy baked in are probably also the least equipped to avoid it, too.
Grepping has commonly been evaded since at least the late 90s. lowercased pointed out the use of request values already. Other techniques include encoding a string or byte array and decoding it into a file, pipe, etc. Static analysis can catch some things but it’s fundamentally the halting problem unless you can apply very restrictive sandbox policies — no file I/O, whitelist a few lines which can do certain operations, etc.