Manipulating strings in mathbot eval

[aj00200]

Using ``s in mathbot commands allows for strings to be quoted and accessed like a list.

The following exploit doesn't quite work, but it does show the danger of this bug:
?math hexec(`cm(1)`[1]+`geo.line(1, 2, 3, 4)`[12]+`geo.line(1, 2, 3, 4)`[9]+`geo.triangle((1,1), (2,1), (3,1))`[4]+`geo.triangle((1,1), (2,1), (3,1))`[2]+`geo.triangle((1,1), (2,1), (3,1))`[4]+`cm(1)`[2]+`[0]`[0]+`[0]`[1]+`[0]`[2])

The team behind this bug has been kept Anonymous. Thank you for reporting :)

[aj00200 (aj00200)]

Here is another example just for fun:
?math `geo.triangle((0,0),(0.5,1),(1,0))`[4]+`geo.triangle((0,0),(0.5,1),(1,0))`[70]*2

[aj00200 (aj00200)]

Here is another example just for fun:
?math `geo.triangle((0,0),(0.5,1),(1,0))`[4]+`geo.triangle((0,0),(0.5,1),(1,0))`[70]*2

[Thomas Ward (teward)]

Patching will take some time, as I am very busy. However, I have assigned this bug to myself so that I can apply the patch to the stable PPA.

[Thomas Ward (teward)]

Update: Patch applied upstream, next package release will be based off of upstream code, including any other revisions.

[Thomas Ward (teward)]

Fix committed upstream

[Thomas Ward (teward)]

https://launchpadlibrarian.net/96787436/bbot_7.0.5-stable-1_7.5.7-1.diff.gz

CHANGELOG:

$RELEASES = lucid, maverick, natty, oneiric, precise

bbot (7.5.7-1) $RELEASES; urgency=medium

  * New upstream release:
    * (git: b37b17f) BBot 7.5.7 - Updated version number
    * (git: 9a27a9c) Fixes bug #952479, "Manipulating
        strings in mathbot eval"
 -- Thomas Ward <email address hidden> Wed, 14 Mar 2012 12:17:18 -0400

[Thomas Ward (teward)]

Fixed in PPA: https://launchpad.net/~bbot+core+developers/+archive/ppa/