News for hackers. Stuff that matters.
Re:Gitlab servers are being exploited in DDoS attacks by winrid on Thursday November 04, 2021 @08:19PM (#29114060)
My personal career favorite use of eval was for an import system that "unrolled" the loop that went through the columns for each row, using eval. It was much faster, but obviously a huge security risk.

Today with modern JIT compilers its probably not much faster...

Re:Gitlab servers are being exploited in DDoS attacks by rsj_hn on Thursday November 04, 2021 @08:26PM (#29114100)
I saw a very similar thing with eval. There was an evaluation of a nested JSON object

    x["a"]["b"]["c"] 
And the developer decided that this was best evaluated by eval. During the code review phase I talked to them and asked why they were using eval, and they didn't know it could be evaluated directly as they were a little unclear if javascript supported that syntax.
Re:Gitlab servers are being exploited in DDoS attacks by jdc on Thursday November 04, 2021 @08:59PM (#29114307)
How much longer did said dev continue working there?
Re:Gitlab servers are being exploited in DDoS attacks by dylan604 on Thursday November 04, 2021 @09:21PM (#29114438)
Fire the dev, or educate the dev. Sure, eval is just a sure sign of a lot of lack of understanding, but I'd hope for something less vile as eval would be a little more understanding that everyone learns something sometime
Re:Gitlab servers are being exploited in DDoS attacks by iratewizard on Thursday November 04, 2021 @10:22PM (#29114782)
It's gross negligence of the dev is only a Javascript dev, but maybe understandable if it's just one of the three languages he uses regularly. I probably wouldn't fire, but I also can't imagine any of my devs doing that.
Re:Gitlab servers are being exploited in DDoS attacks by rsj_hn on Thursday November 04, 2021 @09:05PM (#29114343)
err, no comment
Re:Gitlab servers are being exploited in DDoS attacks by dylan604 on Thursday November 04, 2021 @09:21PM (#29114441)
that dev is now your manager? /s
Re:Gitlab servers are being exploited in DDoS attacks by RexM on Thursday November 04, 2021 @09:42PM (#29114565)
He is the dev
Re:Gitlab servers are being exploited in DDoS attacks by rsj_hn on Thursday November 04, 2021 @10:37PM (#29114892)
LOL, no to both!
Re:Gitlab servers are being exploited in DDoS attacks by mxrlkn on Thursday November 04, 2021 @10:21PM (#29114781)
I was once tasked with creating a new frontend on an old project that had an API endpoint return something like this:

  var array = ["foo", "bar"]
I was expecting xml or json (like the rest of the endpoints), but I realized that they just served this as text, and then eval'd it on the frontend...
Re:Gitlab servers are being exploited in DDoS attacks by david2ndaccount on Thursday November 04, 2021 @10:48PM (#29114940)
This was how you used to do it before JSON.parse was built into the browser.
Re:Gitlab servers are being exploited in DDoS attacks by zmmmmm on Thursday November 04, 2021 @11:11PM (#29115040)
it was literally a pseudo "standard":

https://en.wikipedia.org/wiki/JSONP

Re:Gitlab servers are being exploited in DDoS attacks by mxrlkn on Thursday November 04, 2021 @11:57PM (#29115277)
Right, but for it to be JSONP, the response should be injected into a script tag, I believe.
Re:Gitlab servers are being exploited in DDoS attacks by tentacleuno on Friday November 05, 2021 @03:38AM (#29116386)
And it should be wrapped in a function call (most times, you can choose which function is called by a query parameter).