Just curious, and I haven't googled because I already know it's not going to answer the question ....
So say hypothetically I launch an API to run in-line C code from the terminal. It'd just be a basic shell script that has a skeleton of a .c file and injects STDIN straight into the main function. The only header would be <stdio.h>
Is it possible to do this securely? Or is the simply allowing arbitrary C even with these restrictions a recipe for pwnage.
So it'd be just
In the endpoint directory:
index.php
run.sh
index.php would receive the string and call shell to remove comments
:a;s@//.*@@;ta; :a;s@/\*@@;ta; :a;s@\*/@@;ta;
then it would just echo out
#include <stdio.h>
int main(void) {
**
<<user input>>
**
return 0; }
into a temporary.c , compile, and then php can capture the output into a variable and with that reply to the API call.
I'm gonna do this anyway on a throwaway server but I was wondering mostly out of curiosity whether even this can be exploited. (i.e. somehow adding more headers and executing a fork bomb or something)
Jump in the discussion.
No email address required.
nah, I'm sure it's fine
Jump in the discussion.
No email address required.
thanks everyone in this thread is so negative smh u just gotta have a positive outlook
Jump in the discussion.
No email address required.
They're all ignorant fools for not sharing your vision. Pay them no sneed
Jump in the discussion.
No email address required.
More options
Context
More options
Context
More options
Context