Shell argument injection tweaks #638
Conversation
Tweak required answer to be easier to read *and* more generous.
JavaScript allows string constants with '...' or "..." or `...`
(the last are a template, but you don't HAVE to use {...} inside them).
The shell: false parameter isn't required.
Also, whitespace is interpreted as "0 or more whitespace" in a pattern;
use that to make the patterns easier to read.
Signed-off-by: David A. Wheeler <[email protected]>
Signed-off-by: David A. Wheeler <[email protected]>
We don't require validation, presumably that was done elsewhere. Signed-off-by: David A. Wheeler <[email protected]>
Signed-off-by: David A. Wheeler <[email protected]>
Signed-off-by: David A. Wheeler <[email protected]>
Signed-off-by: David A. Wheeler <[email protected]>
Since the lab doesn't require input validation, there is not need to explain it. Other lessons cover that point. Signed-off-by: David A. Wheeler <[email protected]>
Signed-off-by: David A. Wheeler <[email protected]>
Signed-off-by: David A. Wheeler <[email protected]>
|
@lirantal - Thanks so much for the lab. I made a number of tweaks, e.g., made it more general, removed some unnecessary text, and added a lot of hints. Some developers who take the course may not know JavaScript (or might not know it well), so hints for common mistakes can be a real help. Please let me know what you think. If this is okay, let's declare this done. |
|
Thanks will take a look 👀 |
|
@lirantal - great, thanks! Hopefully this process wasn't too painful. If you're willing to do another, please look at the sections we haven't yet done, and ask me to add you as the assignee. That way, we won't have too many labs on the same sections, with other sections completely uncovered. |
|
Have to admit, the regex parts for the hint checks is kinda annoying but you seem to master that so maybe you'll help me with the next lab too :-) |
|
Python is the hardest for the regex. check.js has a mechanism for changing how it interprets regexes, but in this case, it's probably best to use it the way it is. |
Co-authored-by: Liran Tal <[email protected]> Signed-off-by: David A. Wheeler <[email protected]>
Signed-off-by: David A. Wheeler <[email protected]>
|
We need to add the new lab to the course. Issue to remember that is here: ossf/secure-sw-dev-fundamentals#175 |
2 participants
No description provided.