Fix remote code execution vulnerability

Disable EVAL command as it is open to remote code execution vulnerability slashmili#85
lATAl · Feb 23, 2017 · 45f2c96 · 45f2c96
1 parent abf9d8c
commit 45f2c96
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/CHANGELOG b/CHANGELOG
@@ -2,6 +2,9 @@ Helium (2.X.X)
 v 2.6.0
 	  add g:alchemist_compile_basepath option #78
 
+v 2.5.1
+	- Fix remote code execution vulnerability
+
 v 2.5.0
 	- show documentation for erlang modules #49
 	- stop alchemist server being 10 min idle

diff --git a/alchemist-server/lib/helpers/process_commands.exs b/alchemist-server/lib/helpers/process_commands.exs
@@ -32,8 +32,8 @@ defmodule Alchemist.Helpers.ProcessCommands do
         API.Docl.request(args)
       ["INFO", args] ->
         API.Info.request(args)
-      ["EVAL", args] ->
-        API.Eval.request(args)
+      #["EVAL", args] ->
+        #API.Eval.request(args)
       ["DEFL", args] ->
         API.Defl.request(args)
       ["PING"] ->