News for hackers. Stuff that matters.

A comment on Gitlab servers are being exploited in DDoS attacks. Parent comment

Re:Gitlab servers are being exploited in DDoS attacks by tyingq on Friday November 05, 2021 @07:44AM (#29117885)
Perl does ship a sandbox module called Safe as a standard module, though I don't know how strong it is.
[ Parent | on HN ]
Re:Gitlab servers are being exploited in DDoS attacks by blacksqr on Friday November 05, 2021 @10:41AM (#29119948)
"The Safe module does not implement an effective sandbox for evaluating untrusted code with the perl interpreter."

https://perldoc.perl.org/Safe

[ Parent | on HN ]
Re:Gitlab servers are being exploited in DDoS attacks by tyingq on Friday November 05, 2021 @11:33AM (#29120744)
Yeah, though in this case, whitelisting opcodes probably would have at least avoided qx and ``(both exec()). Avoiding the eval() altogether would be the right path, of course.
[ Parent | on HN ]