x1unix / go-playground

Better Go Playground powered by Monaco editor

Home Page:https://goplay.tools/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Access to files outside the playground project

MrErlison opened this issue · comments

When I was studying templates, I made an example with the text/template package and was able to read some files from the playground operating system, such as hosts, /proc/ etc.

https://goplay.tools/snippet/TPLrvrFb2pZ

@MrErlison did you ran the program on a server environment?

image

If true - those requests are served by the original Go Playground.

If you consider this as a security issue - please address this issue on the official Go bug tracker.

Indeed, a lot of host stuff is available:

https://goplay.tools/snippet/Re3n9OCl_pb

image