Gitlab servers are being exploited in DDoS attacks

Re:Gitlab servers are being exploited in DDoS attacks by xxpor on Thursday November 04, 2021 @08:47PM (#29114235)

With dlopen() and libclang/libgccjit, you could argue C (on an OS that supports dynamic loading) has eval too ;)

[ Parent | on HN ]

Re:Gitlab servers are being exploited in DDoS attacks by cozzyd on Thursday November 04, 2021 @09:50PM (#29114603)

You have system("gcc uploaded.c && ./a.out") too!

[ Parent | on HN ]

Re:Gitlab servers are being exploited in DDoS attacks by Spivak on Thursday November 04, 2021 @10:03PM (#29114662)

But that code doesn’t run in the memory space of the process.

[ Parent | on HN ]

Re:Gitlab servers are being exploited in DDoS attacks by willbudd on Thursday November 04, 2021 @11:53PM (#29115252)

Then compile it as a library, and dlopen() it after all. (I'm just guessing the gp's point was that JIT isn't really an essential modality.)

[ Parent | on HN ]

Re:Gitlab servers are being exploited in DDoS attacks by superjan on Friday November 05, 2021 @02:37AM (#29116108)

Only in programs that invoke it on hacker controlled data.

[ Parent | on HN ]

Re:Gitlab servers are being exploited in DDoS attacks by xxpor on Friday November 05, 2021 @12:13PM (#29121304)

But if you only evoke eval() on non-hacker controlled data in a scripting language, it's probably fine too.

[ Parent | on HN ]