V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
xcatliu
V2EX  ›  程序员

发现可以在 LeetCode 的机器上运行一些脚本

  •  
  •   xcatliu ·
    xcatliu · 2016-01-23 22:29:29 +08:00 · 4040 次点击
    这是一个创建于 3227 天前的主题,其中的信息可能已经有所发展或是发生改变。
    12 条回复    2016-01-24 22:25:18 +08:00
    xcatliu
        1
    xcatliu  
    OP
       2016-01-23 22:42:10 +08:00
    想了想, GitHub 被我删了,免得被大家玩坏了。。。

    已经汇报给 LeetCode 官方
    xcatliu
        2
    xcatliu  
    OP
       2016-01-23 23:43:29 +08:00   ❤️ 1
    Hi,

    First, thanks for reporting to us and deleting the github repo. We do appreciate that you take the time to report us and taking some possible security holes offline so evil minds won't take advantage of this to do something possibly malicious.

    I do realize that you are able to run shell commands, and this is perfectly okay. You can even run `cat /etc/passwd` and that's allowed. The reason is everything is run inside a sandbox which would not affect the host system. However, I do prefer not to show the internal working of how the user code is run as shown in the `ps aux` command, which may tell something to the user more than he/she needs to know.
    virusdefender
        3
    virusdefender  
       2016-01-23 23:58:36 +08:00
    只能说 leetcode 应该是虚拟机运行的,有沙箱但沙箱限制的太松了
    mzer0
        4
    mzer0  
       2016-01-24 00:30:53 +08:00
    @xcatliu 能解释一下技术原理吗?
    dndx
        5
    dndx  
       2016-01-24 01:23:14 +08:00
    xcatliu
        6
    xcatliu  
    OP
       2016-01-24 10:10:06 +08:00
    @virusdefender 是, LeetCode 不担心你能运行 shell 脚本,只是怕你了解运行模式之后,影响到了解题的思路
    xcatliu
        7
    xcatliu  
    OP
       2016-01-24 10:11:00 +08:00
    @mzer0 大部分语音都有执行 shell 命令的方法吧
    xcatliu
        8
    xcatliu  
    OP
       2016-01-24 10:11:19 +08:00
    @dndx 是,别滥用即可
    Arthur2e5
        9
    Arthur2e5  
       2016-01-24 12:54:40 +08:00
    Delbert
        10
    Delbert  
       2016-01-24 15:13:55 +08:00 via iPad
    leetcode 本身还有 shell 专区的,本身就不是漏洞吧……
    xcatliu
        11
    xcatliu  
    OP
       2016-01-24 16:10:12 +08:00
    @Delbert 我也是这么问 LeetCode 的。。
    vanxining
        12
    vanxining  
       2016-01-24 22:25:18 +08:00 via Android
    LeetCode 创始人似乎是能说中文的?
    关于   ·   帮助文档   ·   博客   ·   API   ·   FAQ   ·   实用小工具   ·   2692 人在线   最高记录 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 24ms · UTC 10:23 · PVG 18:23 · LAX 02:23 · JFK 05:23
    Developed with CodeLauncher
    ♥ Do have faith in what you're doing.