arkits/chaddi-tg

/calc command doesn't work.

Closed this issue · 3 comments

leif-erikson commented

Due to changes present in commit 3b1f0b5a3306263467f65df35b292ded60372d7f, the calc command in broken. Please fix.

arkits commented

@Aurumh4x and BunPao have exposed a vulnerability that allows for remote code execution on the machine that runs Chaddi. I'm planning to implement a better expression evaluator to fix this problem correct. Sorry about the trouble!

arkits commented

050feda76606971c6d21a0b60dd015d69f3a3d3e will re-enables /calc. Expression evaluation is now done by numexpr lib.

  • 👎2
leif-erikson commented

@arkits But it doesn't allow RCE now. Where's the fun in that?

  • 😄3