Saturday Lightning Talks
summary
Shows a live vulnerability: calling os.system with ping and passing a user-supplied host lets an attacker append shell commands and execute rm -rf, because the shell parses the whole string. Demonstrates replacing that pattern with subprocess with arg list (no shell parsing) and explains argv semantics, plus practical fixes: use full binary path, sanitize environment, and run services as a non‑root user. Recommends OWASP command injection guidance for examples and checks.
AI-written summary · about
chapters (11)
- 0:00Intro
- 3:29Other Considerations
- 4:05OpenCV
- 9:00Python
- 15:10Flask
- 20:22Elizabeth Weiner
- 26:23Brendan Kelly
- 31:25Cameron Timberlake
- 37:30Ernest Urban
- 42:29Cameron Durham
- 52:10Matt
