Re:Gitlab servers are being exploited in DDoS attacks
by rsj_hn on Thursday November 04, 2021 @08:26PM
(#29114100)
I saw a very similar thing with eval. There was an evaluation of a nested JSON object
x["a"]["b"]["c"]
And the developer decided that this was best evaluated by eval. During the code review phase I talked to them and asked why they were using eval, and they didn't know it could be evaluated directly as they were a little unclear if javascript supported that syntax.
Re:Gitlab servers are being exploited in DDoS attacks
by jdc on Thursday November 04, 2021 @08:59PM
(#29114307)
How much longer did said dev continue working there?
Re:Gitlab servers are being exploited in DDoS attacks
by dylan604 on Thursday November 04, 2021 @09:21PM
(#29114438)
Fire the dev, or educate the dev. Sure, eval is just a sure sign of a lot of lack of understanding, but I'd hope for something less vile as eval would be a little more understanding that everyone learns something sometime
Re:Gitlab servers are being exploited in DDoS attacks
by iratewizard on Thursday November 04, 2021 @10:22PM
(#29114782)
It's gross negligence of the dev is only a Javascript dev, but maybe understandable if it's just one of the three languages he uses regularly. I probably wouldn't fire, but I also can't imagine any of my devs doing that.
Re:Gitlab servers are being exploited in DDoS attacks
by rsj_hn on Thursday November 04, 2021 @09:05PM
(#29114343)
err, no comment
Re:Gitlab servers are being exploited in DDoS attacks
by dylan604 on Thursday November 04, 2021 @09:21PM
(#29114441)
that dev is now your manager? /s
Re:Gitlab servers are being exploited in DDoS attacks
by RexM on Thursday November 04, 2021 @09:42PM
(#29114565)
He is the dev
Re:Gitlab servers are being exploited in DDoS attacks
by rsj_hn on Thursday November 04, 2021 @10:37PM
(#29114892)
LOL, no to both!
Re:Gitlab servers are being exploited in DDoS attacks
by mxrlkn on Thursday November 04, 2021 @10:21PM
(#29114781)
I was once tasked with creating a new frontend on an old project that had an API endpoint return something like this:
var array = ["foo", "bar"]
I was expecting xml or json (like the rest of the endpoints), but I realized that they just served this as text, and then eval'd it on the frontend...
Re:Gitlab servers are being exploited in DDoS attacks
by david2ndaccount on Thursday November 04, 2021 @10:48PM
(#29114940)
This was how you used to do it before JSON.parse was built into the browser.
Re:Gitlab servers are being exploited in DDoS attacks
by zmmmmm on Thursday November 04, 2021 @11:11PM
(#29115040)
it was literally a pseudo "standard":
Re:Gitlab servers are being exploited in DDoS attacks
by mxrlkn on Thursday November 04, 2021 @11:57PM
(#29115277)
Right, but for it to be JSONP, the response should be injected into a script tag, I believe.
Re:Gitlab servers are being exploited in DDoS attacks
by tentacleuno on Friday November 05, 2021 @03:38AM
(#29116386)
And it should be wrapped in a function call (most times, you can choose which function is called by a query parameter).
Today with modern JIT compilers its probably not much faster...