ajaxorg / ace

Ace (Ajax.org Cloud9 Editor)
https://ace.c9.io
Other
26.69k stars 5.28k forks source link

pinkcoding #5610

Open beanscentcodingpad opened 2 months ago

beanscentcodingpad commented 2 months ago

Project name

pinkcoding

Project link

https://www.pinkcoding.com

Logo link

https://www.pinkcoding.com/material/internal/images/pico/pico-mobile.png

Additional information

ScratchPad Swift, Python, Dart, PHP, JAVA Learn Web coding (html, css, php, mysql, javascript, jquery, reactjs) Learn App coding(iOS, dart)

Acknowledgements

kungfooman commented 2 months ago

I have a feeling your site will be hacked very quickly and won't last too long...

import os
import sys

# Get the directory path
dir_path = os.path.dirname(os.path.realpath(__file__))

# Loop through all files in the directory
for file_name in os.listdir(dir_path):
    # Check if the path is a file, not a directory
    if os.path.isfile(os.path.join(dir_path, file_name)):
        # Print the file name
        print(file_name)

# Open file for reading
with open('/etc/passwd', 'r') as file:

    # Read content of file line by line
    for line in file:
        # Print line
        print(line)  

# Close file
file.close()

# Open file for reading
with open('./aot.py', 'r') as file:

    # Read content of file line by line
    for line in file:
        # Print line
        print(line)  

# Close file
file.close() 
andredcoliveira commented 2 months ago

@kungfooman could you expand on what you mean by your comment?

andredcoliveira commented 2 months ago

Hey @beanscentcodingpad. Here's an example PR to get you started in case you find the time to implement this request: #5608

kungfooman commented 2 months ago

@kungfooman could you expand on what you mean by your comment?

I don't know the server architecture, but you can execute code on at least one of his servers. Meaning it just needs e.g. one root exploit and that server is under control of whoever spending a bit of time on hacking it.

andredcoliveira commented 2 months ago

Ah, true. It looks like there are at least some server-side checks in place, though, before executing the code. Though I'm not sure they're robust enough.

beanscentcodingpad commented 2 months ago

Thank you very much ㅜㅜ I fix the problem.