Comment

Comment by staticassertion

Can you elaborate? I don't see how you would exploit Python with a string like that unless there's an `eval` somewhere in Python's logger? I wouldn't exactly put it past the language, for sure, but I'm not aware of that being the case.

The reason this works in the java library is that the library explicitly adds functionality to evaluate the strings that are passed in, and has a meta-language for computing based on those values.

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton