Driving a motorcycle is living on the edge by definition. Imagine how you feel when the thing starts wobbling from under you… This guy tries to keep his act together at 130 miles per hour!
The post Motorcycle Wobble Save At 130MPH appeared first on Viral Viral Videos.
Watching your surroundings through an aerial view is cool and all, but be careful where you go. Drones aren’t exactly commodities or something, so you might find quite a few people interested in them…
The post Surprising Drone Flight Over Los Angeles appeared first on Viral Viral Videos.
"On occasion, SQL Server Management Studio's estimates can be just a little bit off," writes Warrent B.
Jay D. wrote, "On the surface, yeah, it looks like a good deal, but you know, pesky laws of physics spoil all the fun."
"When opening a new tab in Google Chrome I saw a link near the bottom of the screen that suggested I 'Explore the world's iconic locations in 3D'," writes Josh M., "Unfortunately, Google's API felt differently."
Stuart H. wrote, "I think I might have missed out on this deal, the clock was counting up, no I mean down, I mean negative AHHHH!"
"Something tells me this site's programmer is learning how to spell the hard(est) way," Carl W. writes.
"Why limit yourself with one particular resource of the day when you can substitute any resource you want," wrote Ari S.
[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!
The daily news can be heavy to process… Quite literally actually. This cute little doggo tries its best, but newspapers are just so damn heavy these days.
The post Adorable Puppy Struggles To Carry Newspaper appeared first on Viral Viral Videos.
Lucio Crusca was doing a bit of security auditing when he found this pile of code, and it is indeed a pile. It is PHP, which doesn’t automatically make it bad, but it makes use of a feature of PHP so bad that they’ve deprecated it in recent versions: the create_function method.
Before we even dig into this code, the create_function method takes a string, runs eval on it, and returns the name of the newly created anonymous function. Prior to PHP 5.3.0 this was their method of doing lambdas. And while the function is officially deprecated as of PHP 7.2.0… it’s not removed. You can still use it. And I’m sure a lot of code probably still does. Like this block…
public static function markupToPHP($content) {
if ($content instanceof phpQueryObject)
$content = $content->markupOuter();
/* <php>...</php> to <?php...? > */
$content = preg_replace_callback(
'@<php>\s*<!--(.*?)-->\s*</php>@s',
array('phpQuery', '_markupToPHPCallback'),
$content
);
/* <node attr='< ?php ? >'> extra space added to save highlighters */
$regexes = array(
'@(<(?!\\?)(?:[^>]|\\?>)+\\w+\\s*=\\s*)(\')([^\']*)(?:<|%3C)\\?(?:php)?(.*?)(?:\\?(?:>|%3E))([^\']*)\'@s',
'@(<(?!\\?)(?:[^>]|\\?>)+\\w+\\s*=\\s*)(")([^"]*)(?:<|%3C)\\?(?:php)?(.*?)(?:\\?(?:>|%3E))([^"]*)"@s',
);
foreach($regexes as $regex)
while (preg_match($regex, $content))
$content = preg_replace_callback(
$regex,
create_function('$m',
'return $m[1].$m[2].$m[3]."<?php "
.str_replace(
array("%20", "%3E", "%09", " ", "	", "%7B", "%24", "%7D", "%22", "%5B", "%5D"),
array(" ", ">", " ", "\n", " ", "{", "$", "}", \'"\', "[", "]"),
htmlspecialchars_decode($m[4])
)
." ?>".$m[5].$m[2];'
),
$content
);
return $content;
}
From what I can determine from the comments and the code, this is taking some arbitrary content in the form <php>PHP CODE HERE</php> and converting it to <?php PHP CODE HERE ?>. I don’t know what happens after this function is done with it, but I’m already terrified.
The inner-loop fascinates me. while (preg_match($regex, $content)) implies that we need to call the replace function multiple times, but preg_replace_callback by default replaces all instances of the matching regex, so there’s absolutely no reason fo the while loop. Then, of course, the use of create_function, which is itself a WTF, but it’s also worth noting that there’s no need to do this dynamically- you could just as easily have declared a callback function like they did above with _markupToPHPCallback.
Lucio adds:
I was looking for potential security flaws: well, I’m not sure this is actually exploitable, because even black hats have limited patience!
[Advertisement] Utilize BuildMaster to release your software with confidence, at the pace your business demands. Download today!