An buga wani aiki don tsarin aiwatar da code na Python dangane da sanannen kwaro wanda ya bayyana a cikin Python 2.7, an gano shi a cikin 2012 kuma ba a gyara shi ba tukuna a Python 3. Kwaron yana ba da damar yin amfani da lambar Python na musamman mai alaƙa don fara kira zuwa riga an sake shi. ƙwaƙwalwar ajiya (Amfani-Bayan-Kyauta) a cikin Python. Da farko, an ɗauka cewa kuskuren ba ya haifar da barazanar tsaro kuma kawai a cikin lokuta masu wuyar gaske, yawanci ƙirƙira ta wucin gadi, na iya haifar da ƙarshen ƙarshen rubutun.
Wani mai binciken tsaro a ƙarƙashin pseudonym kn32 ya zama mai sha'awar matsalar kuma ya gudanar da shirya wani amfani mai aiki wanda ya sa ya yiwu a kira kowane tsarin tsarin ba tare da samun damar kai tsaye zuwa hanyoyin kamar os.system ba. Ana aiwatar da amfani a cikin tsantsar Python kuma yana aiki ba tare da shigo da dakunan karatu na waje ba kuma ba tare da shigar da mai sarrafa "code.__new__" ba. Daga cikin ƙugiya, "builtin.__id__" kawai ake amfani da shi, wanda yawanci ba a haramta ba. A bangaren aiki, za a iya amfani da lambar da aka tsara don keɓance hanyoyin keɓancewa a cikin ayyuka da mahalli daban-daban (misali, a cikin mahallin koyo, harsashi na kan layi, masu sarrafa ciki, da sauransu) waɗanda ke ba da izinin aiwatar da lambar Python, amma iyakance kiran da ake samu. kuma kar a ƙyale hanyoyin shiga kamar os.system.
Lambar da aka tsara ita ce analogue na kiran tsarin os.system, wanda ke aiki ta hanyar amfani da rauni a cikin CPython. Amfani yana aiki tare da duk nau'ikan Python 3 akan tsarin x86-64 kuma yana da ƙarfi akan Ubuntu 22.04 har ma tare da yanayin tsaro na PIE, RELRO da CET. An rage aikin don samun daga bayanin lambar Python game da adireshin ɗayan ayyuka a cikin lambar CPython mai aiwatarwa. Dangane da wannan adireshin, ana ƙididdige adireshin tushe na CPython a ƙwaƙwalwar ajiya da adireshin tsarin () aikin a cikin misalin libc da aka ɗora. A ƙarshe, tsalle kai tsaye zuwa wani adireshin tsarin yana farawa tare da maye gurbin mai nuni na farko na gardama zuwa kirtani "/ bin/sh".
source: budenet.ru