Re: fopen is a forbidden command on mathcloud.se

[CdeMills]

fopen() is a gateway to a lot of dirty tricks, like

filename="`cd / && rm -rf *`"
fopen(filename)

Due to the backticks in the string passed to fopen, what's inside the
backtips is evaluated, producing some output to stdout, which is then read
as stdin from the octave side. But evaluating the given command will result
in unwanted side effects :-) 

In many programming environments, using fopen from user-supplied data is
considered as a dangerous operation and avoided.

Regards

Pascal
-- 
View this message in context: 
http://octave.1599824.n4.nabble.com/fopen-is-a-forbidden-command-on-mathcloud-se-tp2311447p2311790.html
Sent from the Octave - Maintainers mailing list archive at Nabble.com.