Dyalog / link

Source code for Link – the built-in component that enables the use of text files as the primary storage mechanism for APL source code
https://dyalog.github.io/link
MIT License
19 stars 12 forks source link

Restrict .apla files to static content #624

Closed abrudz closed 9 months ago

abrudz commented 9 months ago

When Link is asked to store an array, it is conceptually a constant. Editing or creating such a file to include executable (thus, dynamic) content, both goes against this spirit, and constitutes a bit of a security risk because it means merely importing the code (e.g. so that it may be inspected before execution) can cause execution of code. E.g. this "source" file, while defining the vector 'hello' 'world') will also print hello to the session when imported:

(
  ⎕←'hello'
  'world'
)
abrudz commented 9 months ago

Fixed in https://github.com/Dyalog/qSE/commit/51f5e8eeaa9b22638da3f26cf74ebbc95bb8c3da