Get the latest tech news
Writing "/etc/hosts" breaks the Substack editor
An exploration of web security mechanisms and their unexpected consequences
Every time I typed the path to the hosts file (/etc/h*sts- intentionally obfuscated to avoid triggering the very issue I'm discussing), my Substack editor would display a "Network Error" and fail to autosave my draft. A pattern emerged: paths to common Linux system configuration files were triggering errors, while slight variations sailed through. If the web application doesn't properly sanitize this input before using it in a system command, it could execute the attacker's code and reveal sensitive information.
Or read this on Hacker News
