{"id":115448,"date":"2024-04-30T13:53:09","date_gmt":"2024-04-30T11:53:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-realizaczii-yazyka-r-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-fajlov-rds-i-rdx"},"modified":"2024-04-30T13:53:09","modified_gmt":"2024-04-30T11:53:09","slug":"uyazvimost-v-realizaczii-yazyka-r-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-fajlov-rds-i-rdx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-realizaczii-yazyka-r-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-fajlov-rds-i-rdx","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb realizimin e gjuh\u00ebs R, q\u00eb mund\u00ebson ekzekutimin e kodit gjat\u00eb procesimit t\u00eb skedar\u00ebve rds dhe rdx.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb implementimin kryesor t\u00eb gjuh\u00ebs s\u00eb programimit R, e cila \u00ebsht\u00eb e orientuar drejt zgjidhjes s\u00eb problemeve p\u00ebr p\u00ebrpunimin statistik dhe analiz\u00ebn dhe vizualizimin e t\u00eb dh\u00ebnave, \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi kritike (CVE-2024-27322), e cila \u00e7on n\u00eb ekzekutimin e kodit gjat\u00eb deserializimit t\u00eb t\u00eb dh\u00ebnave t\u00eb paarritura. Dob\u00ebsia mund t\u00eb eksploatohet gjat\u00eb p\u00ebrpunimit t\u00eb skedareve t\u00eb formatuara posa\u00e7\u00ebrisht n\u00eb formatet RDS (R Data Serialization) dhe RDX, q\u00eb p\u00ebrdoren p\u00ebr shk\u00ebmbimin e t\u00eb dh\u00ebnave midis aplikacioneve. Problemi \u00ebsht\u00eb zgjidhur n\u00eb l\u00ebshimin R 4.4.0. Mund t\u00eb ndiqni l\u00ebshimin e azhurnimeve t\u00eb pakove n\u00eb shp\u00ebrndarjet n\u00eb faqet e Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. <\/p>\n
Dob\u00ebsia shkaktohet nga ve\u00e7orit\u00eb e funksionit readRDS, i cili p\u00ebrdoret p\u00ebr t\u00eb ngarkuar skedar\u00eb n\u00eb formatet RDS dhe RDX, t\u00eb cilat lejojn\u00eb kalimin e objekteve t\u00eb serializuara R p\u00ebr p\u00ebrpunim n\u00eb nj\u00eb sistem tjet\u00ebr. Serializimi ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb fiksojn\u00eb gjendjen dhe p\u00ebr t\u00eb shk\u00ebmbyer grupe t\u00eb dh\u00ebnash midis programeve. Formati RDS lejon ruajtjen e gjendjes p\u00ebr nj\u00eb objekt t\u00eb vet\u00ebm, nd\u00ebrsa formati RDX n\u00eb kombinim me skedar\u00ebt RDB lejon kalimin e informacionit p\u00ebr disa objekte. Problemi \u00ebsht\u00eb i lidhur me faktin se formati RDS mb\u00ebshtet kodin objektik PROMSXP, i lidhur me llojin Promise, i cili p\u00ebrdoret p\u00ebr t\u00eb p\u00ebrcaktuar shprehjet q\u00eb thirren n\u00eb m\u00ebnyr\u00eb asinkrone gjat\u00eb p\u00ebrdorimit t\u00eb vlerave t\u00eb lidhura me to. <\/p>\n
Gjat\u00eb deserializimit, p\u00ebr t\u00eb p\u00ebrcaktuar objektin Promise p\u00ebrdoren tre komponent\u00eb \u2014 vlera e Promise, shprehja dhe mjedisi. N\u00ebse p\u00ebr llojin Promise nuk \u00ebsht\u00eb caktuar nj\u00eb vler\u00eb e llogaritur paraprakisht, at\u00ebher\u00eb ajo llogaritet gjat\u00eb deserializimit duke kryer shprehjen me funksionin \"eval\". K\u00ebshtu, nj\u00eb sulmues mund t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kod t\u00eb rast\u00ebsish\u00ebm n\u00eb gjuh\u00ebn R, duke e vendosur at\u00eb n\u00eb vend t\u00eb shprehjes s\u00eb lidhur me vlerat e pa llogaritura n\u00eb skedar\u00ebt RDS ose RDX. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"