quarto-inputf6b7070bdcfce393

2026-06-16

🔗 shiny::runApp("security/apps/reprex1")

<script>alert()</script>

🔗 shiny::runApp("security/apps/reprex2")

<script>alert()</script>

🔗 shiny::runApp("security/apps/reprex3")

glue("Ton choix est : {input$xyz}")

Hello {1+1}

🔗 shiny::runApp("security/apps/reprex4")

glue(input$xyz)

Hello {1+1}

→ Hello 2.

🔗 shiny::runApp("security/apps/reprex4")

{system("ls /")}
{readLines("/etc/passwd")}
{system("whoami")}
{system("rm -rf /")}
{system("useradd hacker")}

glue("{input$template}")

🔗 shiny::runApp("security/apps/reprex5")

Shiny.setInputValue("color", "{1+1}")

input_color <- match.arg(
  input$color,
  choices = c("red", "green", "blue")
)

🔗 shiny::runApp("security/apps/reprex6")

evil <- function() {
  system("touch /tmp/hacked")
}
saveRDS(evil, "evil.rds")

🔗 shiny::runApp("security/apps/reprex7")

paste0("SELECT … WHERE id = ", input$x)

1 OR 1=1

1; DROP TABLE users

🔗 shiny::runApp("security/apps/reprex8")

Shiny.setInputValue("user_input", "1 OR 1=1")

rv$query <- paste0(
  "SELECT * FROM users WHERE id = ",
  input$user_input
)
rv$result <- dbGetQuery(
  con, rv$query
)

rv$query <- sqlInterpolate(
  con,
  "SELECT * FROM users WHERE id = ?id",
  id = input$user_input
)
rv$result <- dbGetQuery(
  con, rv$query
)

rv$query <- paste0(
  "SELECT * FROM users WHERE id = ",
  input$user_input
)
rv$result <- dbGetQuery(
  con, rv$query
)

rv$query <- glue_sql(
  "SELECT * FROM users WHERE id = {input$user_input}",
  .con = con
)
rv$result <- dbGetQuery(
  con, rv$query
)

🔗 shiny::runApp("security/apps/reprex11")

Salut tout le monde !

🔗 shiny::runApp("security/apps/reprex11")

<script>alert(...)</script>

🔗 shiny::runApp("security/apps/reprex11")

<script>
  ...createElement("button")...
  fakeBtn.onclick = ...
  document.body.prepend(fakeBtn);
</script>

glue::glue(
  "<p><strong>{row$pseudo}</strong>",
  " : {row$message}</p>"
)

glue::glue(
  "<p><strong>{htmlEscape(row$pseudo)}</strong>",
  " : {htmlEscape(row$message)}</p>"
)