-
Notifications
You must be signed in to change notification settings - Fork 42
Open
Description
Packages which introduce init(...) likely need to be audited: these are called during execution and mean that libraries can execute their own behavior at runtime regardless of whether or not affected methods are called.
E.g., it might be alright if CAPABILITY_EXEC was used in a library to help with command execution, but I'd in general be surprised about an init(...) function in that context and especially if init(...) called exec(...) in some way. Introduction (or initial use) of init in libraries should probably be audited, along with periodic re-reviews on version bumps.
phil9909 and satoqz
Metadata
Metadata
Assignees
Labels
No labels