Hacker News new | past | comments | ask | show | jobs | submit login

"We've found 99,841 code results"

Someone should write a script that automatically raises an issues for each line and each project, it's probably possible, but I'm chronically lazy.




I remember reading about something like this and Github their response was that the guy should stop according to their ToS. Their ToS blocks stuff like this to prevent spamming.


As noted in other comment(s), there are legit uses for this.


Can you please provide just one? No other comment does that.

And to be clear, I'm talking about providing at least one legit use for passing user input directly to exec without any kind of filtering...


Test cases for a PHP vulnerability scanner[1]

[1] https://news.ycombinator.com/item?id=7665232


The sourcecode of a hypothetical Github commenting bot searching for this vulnerability will have the same search token, and will be flagged.


A great example is: https://github.com/andresriancho/w3af-moth

He deliberately wrote vulnerable code to test his auditing script. There are more repos like this.


That's fair. But that's also the vast minority of these results that I can tell...


I thought about doing the exact same thing. But I wonder about the: limiting of the issue creation API on github and false positives. [The variable has been sanitized prior to being executed]


I don't like Issue bots, but it could actually be a huge value-add for GitHub to integrate these kinds of checks (as well as hardcoded credentials, etc) for their users.


Well, some of them are false positives.


After looking at the search result i can see that most of the results have legit reasons.

Instead of half-assing the problem, please dedicate 10 minute of your life to look in, analyze & report one or two of the problems you find.

Also explain why you think this is an security issue.

You will:

  * help someone out by pointing out an issue

  * hopefully educate the person how to write better code

  * educate yourself in reading and understanding others spaghetti code




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: