You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, the task runner can be manually called with a correctly crafted command instruction. This is supposedly different from Laravel 11's new Concurrency module, which runs the task in a hidden Artisan command.
This allows attackers to just input whatever stuff into the command line to run arbitrary code.
We have 2 options:
Try to understand how this Concurrency module handles "hidden Artisan commands", and learn from them; or
Add a way for this library to verify the runner instruction is sent from itself, and is not from an outsider
The text was updated successfully, but these errors were encountered:
Currently, the task runner can be manually called with a correctly crafted command instruction. This is supposedly different from Laravel 11's new Concurrency module, which runs the task in a hidden Artisan command.
This allows attackers to just input whatever stuff into the command line to run arbitrary code.
We have 2 options:
The text was updated successfully, but these errors were encountered: