{"action":"created","issue":{"url":"https://api.github.com/repos/emgram769/lighthouse/issues/75","labels_url":"https://api.github.com/repos/emgram769/lighthouse/issues/75/labels{/name}","comments_url":"https://api.github.com/repos/emgram769/lighthouse/issues/75/comments","events_url":"https://api.github.com/repos/emgram769/lighthouse/issues/75/events","html_url":"https://github.com/emgram769/lighthouse/issues/75","id":107571182,"number":75,"title":"Horrible security flaw in cmd.py","user":{"login":"kahrkunne","id":6626453,"avatar_url":"https://avatars.githubusercontent.com/u/6626453?v=3","gravatar_id":"","url":"https://api.github.com/users/kahrkunne","html_url":"https://github.com/kahrkunne","followers_url":"https://api.github.com/users/kahrkunne/followers","following_url":"https://api.github.com/users/kahrkunne/following{/other_user}","gists_url":"https://api.github.com/users/kahrkunne/gists{/gist_id}","starred_url":"https://api.github.com/users/kahrkunne/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kahrkunne/subscriptions","organizations_url":"https://api.github.com/users/kahrkunne/orgs","repos_url":"https://api.github.com/users/kahrkunne/repos","events_url":"https://api.github.com/users/kahrkunne/events{/privacy}","received_events_url":"https://api.github.com/users/kahrkunne/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-21T18:31:02Z","updated_at":"2015-09-30T15:02:58Z","closed_at":null,"body":"In cmd.py, line 201 says \"out = eval(userInput)\". This is an enormous security flaw, to the point where, if you are using cmd.py as cmd for lighthouse, even typing \"os.system('rm -rf \\*')\" in the window, *without pressing enter*, will delete all your files. ==SO DON'T DO THIS==\r\n\r\nBeing able to run an arbitrary command just by typing it is really horrible. Code shouldn't be executed just by typing it, and this is unlike any other behaviour in lighthouse."},"comment":{"url":"https://api.github.com/repos/emgram769/lighthouse/issues/comments/144439000","html_url":"https://github.com/emgram769/lighthouse/issues/75#issuecomment-144439000","issue_url":"https://api.github.com/repos/emgram769/lighthouse/issues/75","id":144439000,"user":{"login":"emgram769","id":2738221,"avatar_url":"https://avatars.githubusercontent.com/u/2738221?v=3","gravatar_id":"","url":"https://api.github.com/users/emgram769","html_url":"https://github.com/emgram769","followers_url":"https://api.github.com/users/emgram769/followers","following_url":"https://api.github.com/users/emgram769/following{/other_user}","gists_url":"https://api.github.com/users/emgram769/gists{/gist_id}","starred_url":"https://api.github.com/users/emgram769/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/emgram769/subscriptions","organizations_url":"https://api.github.com/users/emgram769/orgs","repos_url":"https://api.github.com/users/emgram769/repos","events_url":"https://api.github.com/users/emgram769/events{/privacy}","received_events_url":"https://api.github.com/users/emgram769/received_events","type":"User","site_admin":false},"created_at":"2015-09-30T15:02:57Z","updated_at":"2015-09-30T15:02:57Z","body":"this is a good point, it really should only execute when a specific key is hit.\r\nany suggestions for alternative interfaces kahrkunne? perhaps something like `eval this part`?"}}