Where do you see the problematic interpolation? | Hacker News

Hacker News new | past | comments | ask | show | jobs | submit

login

mbrock on Sept 2, 2019 | parent | context | favorite | on: Building Interactive SSH Applications

Where do you see the problematic interpolation?

targonca on Sept 2, 2019 | [–]

    keys = (f"command=\"buildsrht-shell '{b64key}'\",restrict,pty " +
            f"{key_type} {b64key} somebody\n")

Now it depends on how b64key is sanitized.

megous on Sept 2, 2019 | [–]

AuthorizedKeysCommand, see above

Join us for AI Startup School this June 16-17 in San Francisco!
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact