search

hubot-archive / hubot-google-translate

Allows Hubot to know many languages using Google Translate
63 stars 36 forks source link

Data returned by google API is blindly eval'd #1

Open jvennix-r7 opened 10 years ago

jvennix-r7 commented 10 years ago

This could allow arbitrary code execution if google ever responded with something that could be interpreted as executable code. The offending code is here:

https://github.com/hubot-scripts/hubot-google-translate/blob/master/src/google-translate.coffee#L106

I think JSON.parse() would be the easy fix.

therealklanni commented 10 years ago

Feel free to submit a PR for that change and someone will be happy to merge. Don't forget to update any tests. :+1:

Zuhair5030 commented 1 year ago

https://user-images.githubusercontent.com/127550738/224427151-4839bf7a-f89a-463d-825b-b90b26f7fb98.mp4