OBJ is a file format for describing 3D shapes of things, e. g. for 3D printing. A .obj file contains data lines that define coordinates of points, corners and colors of polygons, curved surfaces, etc.
Today I learned that version 3.0 of the OBJ format may include lines like this:
csh <command>
Executes the requested UNIX <command>.
Sigh. Have we learned nothing since the Morris Internet Worm?
I have heard of IT security managers horrified by the code that programmers now write with the "help" of LLMs.
But the difference is just where the code is being run.
Automatically running untrusted code without a proper sandbox is a bad idea.
In one scenario the code is run without the possibility of any review. In principle a sandbox can address the risks in that (I hope you didn't let an AI implement your sandbox).
In the other scenario the code can in principle be reviewed by a human before being run. But I don't think either of trust that such a review will happen.
More likely many developers will run the code produced by the AI without reading it first, and they will do so in an environment which isn't properly sandboxed.
And if they don't notice anything wrong they may submit it for review where the first person to read the code will be somebody else, who may or may not know that it was written by AI.
Forbidding the use of such code generators may be a bit extreme. But maybe that's what we need to balance out the current hype.
I fully agree that using automated tools for tasks you don't know how to do manually is bad because you don't know what you are doing.
The area where I see the most potential for AI generated code is for unit tests. But before doing that we need better tools for evaluating some sanity aspects of unit tests.
Code coverage is one measurable metric, but I would take it a step further and not just require each line to be covered by tests. Instead I want each conditional in the code to be tested with both a true and a false value.
Moreover I want it to be such that if you actually negate a condition in the code itself, there must be a unit test failing. And if a particular test case passed regardless of what modification was being made to the code being tested, then that test case was not particular useful in the first place.
If generated test cases satisfy all of that, then there is a chance that reviewing those test cases could be less work than writing the from scratch yourself. All of this is of course hypothetical, as I have not yet seen an AI as capable as what I describe (and I haven't been looking for one either).
But never send them to somebody else for review without reviewing them first for yourself.
Hold my beer...
from the Wikipedia article on SVG, the most common vector image format on the net:
As a document format, similar to HTML documents, SVG can host script or CSS. This is an issue when an attacker can upload a SVG file to a website, such as a profile picture, and the file is treated as a normal picture but contains malicious content.[79] For instance, if an SVG file is deployed as a CSS background image, or a logo on some website, or in some image gallery, then when the image is loaded in a browser it activates a script or other content. This could lock up the browser (the Billion laughs attack), but could also lead to HTML injection and cross-site scripting attacks. The W3C therefore stipulate certain requirements when SVG is simply used for images: SVG Security.[80]
The W3C says that Inline SVG (an SVG file loaded natively on a website) is considered less of a security risk because the content is part of a greater document, and so scripting and CSS would not be unexpected
Yes, but CSS and javascript are supposed to be "sandboxed" so they should ("should") not have any effect outside the browser window where the page is displayed.
Whereas those "csh" commands are supposed to be able to do anything that the program loading the .obj file could do. Like "cd; rm -rf *"...
"should", indeed.
But if you're lucky, you're opening the malware OBJ file on a machine that doesn't have csh installed.
I have no idea what was the intended use. But adding a shell escape to a special-purpose language is a hack that is tempting to many hackers. Makefiles have it. POV-Ray files have it...
@JorgeStolfi The time for this complaint would have been the early ‘90s.
And no, nobody even considered defending against things like the Morris Worm for quite a long time after.
Jorge Stolfi
Gorgeous na Shock!
mcc
Bill Seitz
Michael Westergaard
kasperd
-dsr- (hypoparenthetically)
Alexandre Oliva (moved to @
Peter Bindels
Ian Jackson
Resuna
Solace-10
Alex Rosenberg