Here is an example how you can use Help Insight to do a google search. The #0 at the string’s end makes it possible. I doubt that that was intended.
Here is an example how you can use Help Insight to do a google search. The #0 at the string’s end makes it possible. I doubt that that was intended.
Nice 🙂
Even automatic referral works:
const
Google: String = ”#0;
But the IDE doesn’t let me type inside the Help Insight window, so I can’t really do a Google search 🙁
Forgot to escape < and >.
const
Google: String = ‘<meta http-equiv=”refresh” content=”0; URL=http://www.google.com/”>’#0;
First reaction is that is funny.
After that tho, my second reaction is : Have you reported this to QC is a security risk?
The larger security risk is the IDE’s AutoRun registry key.
Well, if it is a security risk or not it depends in the point of view, since a programmer needs full access to the development environment and should know what is running in his development system. Here is where personal responsability and smart strategies of security take place (using VMs, not installing crap in your dev environment, etc).
Anyway the IDE can be enhanced by logging and showing easily the information related to the programs that are executed automatically and which urls are open… but of course we all may agree that we prefer the IDE get enhanced in many other aspects first heh.
This year has taught us all that Delphi has become a valid target for malicious attacks. Anyone care to explain how a simple fix to the IDE to reduce that attack surface is a bad thing?
Andreas -> yes and no. Since you can use the traditional spaces padding to hide the malicious part of the string off the edge of the screen, all you need to do is browse the constant. Then IE gets involved in the mix and suddenly you’ve been redirected to website which has an IE exploit capable of dropping anything it wants on your machine.
The IDE’s autorun registry key is bad, but you already have to be infected with a binary for it to take. This only requires that you browse seemingly safe source code. We all get source from outside sources and to make sure it is safe to use, we inspect the code. Now that inspection process itself runs a risk of getting infected. That seems worse than an autorun registry key that only works if you are ALREADY infected (making it somewhat moot). But hey, if you are still worried about it, consider the autorun a potential target for an exploit that makes it in to your machine through an IE exploit triggered by maliciously crafted source and help-insight.