SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Developer Finds DNS Field in Sonar App Could Execute Commands as Root

0
·2 views

A security review of the open-source network tool Sonar revealed that its custom DNS resolver input field could be exploited to run arbitrary commands with root privileges. The flaw stemmed from passing unvalidated user input directly into a privileged shell call using networksetup, a system utility on macOS. The developer discovered the issue during a pre-release audit ahead of version 2 and fixed it by validating input against an allowlist of IPv4/IPv6 addresses and passing arguments as an array instead of a shell string. Several other vulnerabilities were also found, including CSV formula injection in network exports and insecure credential storage. The developer noted that such flaws arise not from ignorance but from insufficient scrutiny of input boundaries outside the main feature-building process.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Six Lessons from Building and Running a Cross-Border Shopping Marketplace for Six Years

Shpper is a two-sided cross-border personal-shopping marketplace where buyers request items and shoppers abroad purchase and ship them, with its CTO managing the entire platform over fourteen major versions. Running such a platform means maintaining two separate apps simultaneously, as both buyer and shopper sides must stay in sync before any feature change can go live. The platform's core product is trust between strangers, enforced through escrow payments and identity verification, which together ensure neither party is exposed to undue financial risk. Bugs involving money are treated as a distinct, more serious category since a double-charge or failed transaction cannot simply be corrected in code — the funds have already moved. Cross-border complexity adds further challenges including currency fluctuation and unpredictable customs duties, requiring the system to handle instability as a default condition rather than an edge case.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Flutter Web 404 Pages Can Crash Silently While Servers Return Wrong Status Codes

A Flutter web developer discovered that their 404 error page had been silently crashing for an extended period, masked by a Firebase Hosting misconfiguration that returned HTTP 200 instead of 404 for missing routes. The catch-all rewrite rule was serving the 404 page with a success status, creating so-called soft 404s that misled search crawlers into indexing non-existent pages. The actual page crash stemmed from a go_router bug where the errorBuilder renders outside any RouteBase context, making GoRouterState.of(context) throw an unconditional error with no nullable fallback available. The fix involved removing the catch-all rewrite rule so the server returns genuine 404 status codes, and falling back to Uri.base.path in a try-catch block when GoRouterState is unavailable. The author notes the two bugs concealed each other — the status-code fix prompted someone to actually visit the page, which is what finally exposed the rendering crash.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Hand-Builds Flutter Treemap for Disk Browser After Packages Fall Short

A developer building Helm, a macOS disk storage tool, chose to write a custom treemap widget from scratch instead of using existing Flutter charting packages. The decision was driven by four requirements that off-the-shelf packages could not handle together: precise hit-testing to identify folders, navigation as a stateful operation with breadcrumb support, adaptive labels based on rectangle size, and layout computed one tree level at a time rather than over a flat list. The implementation uses the squarified treemap algorithm, which keeps rectangles closer to square by sorting values descending and greedily accumulating tiles before closing each row. To handle large volumes with hundreds of thousands of files, scanning runs off the main isolate and layout is computed only for the currently visible level. Helm is released under the MIT licence, with the treemap widget available in its open-source GitHub repository.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

ImpactSync Turns Messy Field Notes into Donor Reports and Aid Alerts

ImpactSync is an AI-powered tool designed to reduce administrative burden on humanitarian frontline workers and mutual-aid volunteers. After long operational shifts, relief teams often struggle to produce supply lists, donor reports, and public mobilization posts while physically exhausted. The tool accepts informal, unstructured notes — including voice dictations or fragmented text — and processes them through Google Gemini to generate three structured outputs. These include prioritized resource deficit tags, formal donor accountability briefs, and short-form social media mobilization posts for platforms like X and Instagram. Built on Node.js and Express.js, ImpactSync aims to cut communication delays and prevent resource gaps during active disaster response operations.

0 comments Read more at DEV Community