gosoccerboy5 wrote:

(#1420)
I wish we had a forum nerd emoji

Vaibhs11 wrote:

(#1419)

if 1:

Chiroyce wrote:

DifferentDance8 wrote:

mybearworld wrote:

the worst part of this is that a variable is named “bool”

import os
def print(something):
    os.system(f"echo {something}")
print("mybearworld")

your code is vulnerable to code injection, if i run the below, all your files are gone forever

print("'bye bye lol'; rm -rf ~/*")

use the subprocess module instead

from subprocess import run
def print(something):
	run(["echo", something])
print("mybearworld")

run(["/usr/bin/echo", something])

Maximouse wrote:

(#1422)

Chiroyce wrote:

DifferentDance8 wrote:

mybearworld wrote:

the worst part of this is that a variable is named “bool”

import os
def print(something):
    os.system(f"echo {something}")
print("mybearworld")

your code is vulnerable to code injection, if i run the below, all your files are gone forever

print("'bye bye lol'; rm -rf ~/*")

use the subprocess module instead

from subprocess import run
def print(something):
	run(["echo", something])
print("mybearworld")

This is still vulnerable – an attacker can put a file named “echo” in the working directory. Using an absolute path is safer:

run(["/usr/bin/echo", something])

print(something)

mybearworld wrote:

(#1423)

Maximouse wrote:

(#1422)

Chiroyce wrote:

DifferentDance8 wrote:

mybearworld wrote:

the worst part of this is that a variable is named “bool”

import os
def print(something):
    os.system(f"echo {something}")
print("mybearworld")

your code is vulnerable to code injection, if i run the below, all your files are gone forever

print("'bye bye lol'; rm -rf ~/*")

use the subprocess module instead

from subprocess import run
def print(something):
	run(["echo", something])
print("mybearworld")

This is still vulnerable – an attacker can put a file named “echo” in the working directory. Using an absolute path is safer:

run(["/usr/bin/echo", something])

This is still vulnerable – an attacker can put a file named “subprocess.py” in the working directory. Not doing it like that is safer:

print(something)

gosoccerboy5 wrote:

I wish we had a forum nerd emoji

Maximouse wrote:

This is still vulnerable – an attacker can put a file named “echo” in the working directory. Using an absolute path is safer:

try {
    throw "ball";
} catch (ball) {
    console.log("I caught a " + ball);
}

Chiroyce wrote:

(#1426)

Maximouse wrote:

This is still vulnerable – an attacker can put a file named “echo” in the working directory. Using an absolute path is safer:

Ah I said that because in case the print function takes user input it would be a problem. Also what mybearworld makes sense, if you anyways have access to the filesystem then this is pointless and my point still stands.

also i think i posted this before but this is still funny lol

try {
    throw "ball";
} catch (ball) {
    console.log("I caught a " + ball);
}

no template strings as djangobb formatter doesnt support it

try {
    throw Math.random() <= 0.5 ? "ball" : Error();
} catch (ball) {
    console.log("I caught " + (String(ball).toLowerCase().startsWith("a") || String(ball).toLowerCase().startsWith("e") || String(ball).toLowerCase().startsWith("i") || String(ball).toLowerCase().startsWith("o") || String(ball).toLowerCase().startsWith("u") ? "an" : "a") + " " + ball);
}

mybearworld wrote:

gosoccerboy5 wrote:

(#1420)
I wish we had a forum nerd emoji

mybearworld wrote:

[offtopic]why do people always use [code=python] instead of [code py3]? it actually has correct syntax highlighting![/offtopic]

gosoccerboy5 wrote:

yes ik about forumoji but who the * wants to use that every time they want an emoji lmao

gosoccerboy5 wrote:

(#1429)
also, `exec` and `input` are safe together right?

exec(input("What code you want to run today?"))

should be fine right?

mybearworld wrote:

Chiroyce wrote:

(#1426)

Maximouse wrote:

This is still vulnerable – an attacker can put a file named “echo” in the working directory. Using an absolute path is safer:

Ah I said that because in case the print function takes user input it would be a problem. Also what mybearworld makes sense, if you anyways have access to the filesystem then this is pointless and my point still stands.

also i think i posted this before but this is still funny lol

try {
    throw "ball";
} catch (ball) {
    console.log("I caught a " + ball);
}

no template strings as djangobb formatter doesnt support it

Such bad exception handling!
This is how it's supposed to be:

try {
    throw Math.random() <= 0.5 ? "ball" : Error();
} catch (ball) {
    console.log("I caught " + (String(ball).toLowerCase().startsWith("a") || String(ball).toLowerCase().startsWith("e") || String(ball).toLowerCase().startsWith("i") || String(ball).toLowerCase().startsWith("o") || String(ball).toLowerCase().startsWith("u") ? "an" : "a") + " " + ball);
}

mybearworld wrote:

Maximouse wrote:

This is still vulnerable – an attacker can put a file named “echo” in the working directory. Using an absolute path is safer:

run(["/usr/bin/echo", something])

This is still vulnerable – an attacker can put a file named “subprocess.py” in the working directory. Not doing it like that is safer:

print(something)

NanoRook wrote:

least boilerplate filled java code

PkmnQ wrote:

(#1437)

PkmnQ wrote:

Email addresses can be valid expressions in python, it just takes a bit of preparation.

class Before:
    def __init__(self):
        self.smith = After()
        self.com = After()
class After:
    def __matmul__(self,other):
        return "Python email address"
john = Before()
example = Before()
print(john.smith@example.com)

class Name(list):
    def __init__(self, name):
        super().__init__(name.split("."))
    def __getattr__(self, name):
        self.append(name)
        return self
    def __str__(self):
        return ".".join(iter(self))
    def __repr__(self):
        return f"Name({str(self)!r})"
    def __matmul__(self, domain):
        return Email(self, domain)
class Email(tuple):
    def __new__(self, name, domain):
        return super().__new__(Email, (name, domain))
    def __str__(self):
        return f"{self[0]}@{self[1]}"
    def __repr__(self):
        return f"Email{super().__repr__()}"
john = Name("john")
example = Name("example")
email = john.smith@example.com
print(email)
print(repr(email))

theonlygusti wrote:

This one is from C++, another macro:

#include <iostream>
#define System S s;s
#define public
#define static
#define void int
#define main(x) main()
struct F{void println(char* s){std::cout << s << std::endl;}};
struct S{F out;};
/* this guy's a genius... */
public static void main(String[] args) {
  System.out.println("Hello World!");
}