Confusing code example in Section 5: Untrusted Code
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- elixir
- Domain
- documentation, security
Research direction
Start in Section 5: Untrusted Code and inspect the two shown Elixir snippets. Compare the reported Code.eval_string("a", a: textfield_value) example with the suggested Code.eval_string(textfield_value) form, then confirm which input demonstrates the intended insecurity. Done means the lesson example and explanation no longer confuse readers.
Written by the indexing model from the issue text.
Description
In Section 5: Untrusted Code there's this example that is suggested to be insecure:
name = Kino.Input.text("What's your name?")
textfield_value = Kino.Input.read(name)
{result, binding} = Code.eval_string("a", a: textfield_value)
"Hello, " <> result
We did this security training at my small team at work and none of us could figure out how to choose an input that would prove that this code is insecure. See screenshot for example. Is it possible that this example is not correct? Was it supposed to say Code.eval_string(textfield_value) instead? That would definitely be insecure.
- Dominant language
- Elixir
- Stars
- 732
- Forks
- 172
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from erlef/elixir-secure-coding
-
small adjustment
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
elixir content new content non-elixir content
erlef/elixir-secure-coding#24 · 1 assignee ·
-
discussion elixir content new content
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Nerves Security Opendiscussion elixir content new content
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
LiveView Security Openelixir content new content
Difficulty 5/5 Over a week Newbie friendliness 25/100
All issues in erlef/elixir-secure-coding
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
carverauto/serviceradar#4596 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
agentjido/jido_harness#80 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
sevenseacat/cinder#235 ·