{"action":"created","issue":{"url":"https://api.github.com/repos/Qirky/FoxDot/issues/9","repository_url":"https://api.github.com/repos/Qirky/FoxDot","labels_url":"https://api.github.com/repos/Qirky/FoxDot/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/Qirky/FoxDot/issues/9/comments","events_url":"https://api.github.com/repos/Qirky/FoxDot/issues/9/events","html_url":"https://github.com/Qirky/FoxDot/issues/9","id":170218630,"number":9,"title":"security of OSCFunc","user":{"login":"claudeha","id":10728495,"avatar_url":"https://avatars.githubusercontent.com/u/10728495?v=3","gravatar_id":"","url":"https://api.github.com/users/claudeha","html_url":"https://github.com/claudeha","followers_url":"https://api.github.com/users/claudeha/followers","following_url":"https://api.github.com/users/claudeha/following{/other_user}","gists_url":"https://api.github.com/users/claudeha/gists{/gist_id}","starred_url":"https://api.github.com/users/claudeha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/claudeha/subscriptions","organizations_url":"https://api.github.com/users/claudeha/orgs","repos_url":"https://api.github.com/users/claudeha/repos","events_url":"https://api.github.com/users/claudeha/events{/privacy}","received_events_url":"https://api.github.com/users/claudeha/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-09T17:01:37Z","updated_at":"2016-08-10T14:22:54Z","closed_at":"2016-08-10T14:22:54Z","body":"There should be a warning in the getting started guide about\r\n\r\n    msg[1].asString.interpret;  //will execute the string sent from python\r\n\r\nbecause the OSCFunc can be triggered by anything with access to the port, and unixCmd exists in SC (so anything with access to the port can run arbitrary code on the system  as the user running SC).\r\n\r\nSuggest using a strong firewall that blocks access from outside.\r\n\r\nA strong TODO item should be figuring out a way to communicate with SC that doesn't go via network OSC, and so can't be injected."},"comment":{"url":"https://api.github.com/repos/Qirky/FoxDot/issues/comments/238882271","html_url":"https://github.com/Qirky/FoxDot/issues/9#issuecomment-238882271","issue_url":"https://api.github.com/repos/Qirky/FoxDot/issues/9","id":238882271,"user":{"login":"Qirky","id":1469662,"avatar_url":"https://avatars.githubusercontent.com/u/1469662?v=3","gravatar_id":"","url":"https://api.github.com/users/Qirky","html_url":"https://github.com/Qirky","followers_url":"https://api.github.com/users/Qirky/followers","following_url":"https://api.github.com/users/Qirky/following{/other_user}","gists_url":"https://api.github.com/users/Qirky/gists{/gist_id}","starred_url":"https://api.github.com/users/Qirky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Qirky/subscriptions","organizations_url":"https://api.github.com/users/Qirky/orgs","repos_url":"https://api.github.com/users/Qirky/repos","events_url":"https://api.github.com/users/Qirky/events{/privacy}","received_events_url":"https://api.github.com/users/Qirky/received_events","type":"User","site_admin":false},"created_at":"2016-08-10T14:22:54Z","updated_at":"2016-08-10T14:22:54Z","body":"Hi Claude, SuperCollider now receives a filename of a local file that contains the SynthDef information and adds it to the server instead of interpreting SCLang code directly."}}
{"actor":{"display_login":"Qirky"}}