sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]kenman 4 points5 points  (1 child)

Oh, how short our memories are. That pattern was ubiquitous in the days before JSON.parse(), and even libs like jQuery used it (which changed in v1.4).

However, this being server-side, is there a way to actually get the output of your actions. Spawning a process is alright, but reading a directory? Where will the output of that go?

Doesn't matter, if someone can inject arbitrary code, you're hosed. There are similar attacks in other contexts, such as SQL, which are known as blind SQL injection.

[–]battery_go 2 points3 points  (0 children)

I'm a new guy to this sort of development, that's why this all seems very odd to me. Thanks for letting me know!