{"action":"created","issue":{"url":"https://api.github.com/repos/weavejester/environ/issues/37","labels_url":"https://api.github.com/repos/weavejester/environ/issues/37/labels{/name}","comments_url":"https://api.github.com/repos/weavejester/environ/issues/37/comments","events_url":"https://api.github.com/repos/weavejester/environ/issues/37/events","html_url":"https://github.com/weavejester/environ/pull/37","id":105408006,"number":37,"title":"Use edn/read-string to read .lein-env","user":{"login":"timvisher","id":34676,"avatar_url":"https://avatars.githubusercontent.com/u/34676?v=3","gravatar_id":"","url":"https://api.github.com/users/timvisher","html_url":"https://github.com/timvisher","followers_url":"https://api.github.com/users/timvisher/followers","following_url":"https://api.github.com/users/timvisher/following{/other_user}","gists_url":"https://api.github.com/users/timvisher/gists{/gist_id}","starred_url":"https://api.github.com/users/timvisher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timvisher/subscriptions","organizations_url":"https://api.github.com/users/timvisher/orgs","repos_url":"https://api.github.com/users/timvisher/repos","events_url":"https://api.github.com/users/timvisher/events{/privacy}","received_events_url":"https://api.github.com/users/timvisher/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-09-08T15:38:06Z","updated_at":"2015-09-09T17:30:13Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/weavejester/environ/pulls/37","html_url":"https://github.com/weavejester/environ/pull/37","diff_url":"https://github.com/weavejester/environ/pull/37.diff","patch_url":"https://github.com/weavejester/environ/pull/37.patch"},"body":"Under extremely limited circumstances, arbitrary code could be executed by an attacker who had access to the CWD of the java process that used `environ` to access the environment variables.\r\n\r\n_*It's important to note that the attacker had to have access to the CWD in order to accomplish the attack*_ so if your system is compromised in this way you have much bigger fish to fry.\r\n\r\nThis change uses edn's reader to restrict the reading of the file's content to data structures only rather than arbitrary code.\r\n\r\n# Functional Testing\r\n\r\n- [x] Make a `checkouts` of this in a project and verify that it still behaves the same."},"comment":{"url":"https://api.github.com/repos/weavejester/environ/issues/comments/138984697","html_url":"https://github.com/weavejester/environ/pull/37#issuecomment-138984697","issue_url":"https://api.github.com/repos/weavejester/environ/issues/37","id":138984697,"user":{"login":"timvisher","id":34676,"avatar_url":"https://avatars.githubusercontent.com/u/34676?v=3","gravatar_id":"","url":"https://api.github.com/users/timvisher","html_url":"https://github.com/timvisher","followers_url":"https://api.github.com/users/timvisher/followers","following_url":"https://api.github.com/users/timvisher/following{/other_user}","gists_url":"https://api.github.com/users/timvisher/gists{/gist_id}","starred_url":"https://api.github.com/users/timvisher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timvisher/subscriptions","organizations_url":"https://api.github.com/users/timvisher/orgs","repos_url":"https://api.github.com/users/timvisher/repos","events_url":"https://api.github.com/users/timvisher/events{/privacy}","received_events_url":"https://api.github.com/users/timvisher/received_events","type":"User","site_admin":false},"created_at":"2015-09-09T17:30:13Z","updated_at":"2015-09-09T17:30:13Z","body":"> Another problem with the code as you have it is that it obscures the original error message. Arguably that would actually make it harder for people to debug, as they can no longer see what part of the file is causing the problem.\r\n\r\nThe original error is there in the cause of the IllegalArgumentException, right?"}}