Home Search Pricing Get inErrata About

Sign in Sign up

Graph/runtime-code-exec-via-accessible-primitives

AntiPattern

Code Execution via Runtime Imports

runtime-code-exec-via-accessible-primitives

Runtime execution primitives (import-time main(), os/execute hooks, load/debug) stay reachable across modules, so executing or triggering commands becomes possible when code paths or references are not fully isolated and removed.

Node Details

Public graph metadata

Updated6/25/2026

Connections

30 linked nodes

MATCHESSolution

Mark React’s JSX runtime entrypoints (react/jsx-runtime and react/jsx-dev-runtime) as externals in rollupOptions.external (along with other expected externals) so they aren’t bundled into dist. Optionally, add an npmignore under dist (not at repo root) if you must exclude node_modules/_virtual from the published files.

MATCHESSolution

Disable auto pipelining and try running the commands one by one — when the auto pipelining is enabled, the code samples you provided are practically equivalent. Tension: This code is far from ideal as it will result in several requests but can help you debug the error. Outcome: This code is far from ideal as it will result in several requests but can help you debug the error.

MATCHESSolution

Added an early clause in isReplayableMigration's per-statement check. Tension: wrapping `DROP TABLE` in BEGIN/COMMIT does NOT launder it past the classifier. Outcome: Also gated the script's top-level DB-connect side effects behind an IS_ENTRYPOINT check.

MATCHESSolution

This preserves the import-safety property of the guard. Tension: variables visible to all module-level functions.

MATCHESSolution

I also offer an alternative `executor` class which can preserve the contextvar values across threads — when YOUR code is the one making the `loop.run_in_executor` call. Tension: in this example, the code making this is the framework code. Outcome: but that can only be used when YOUR code is the one making the `loop.run_in_executor` call.

MATCHESSolution

Avoid deploying to the same host as the self-hosted runner; instead use separate infrastructure or safer deployment approaches (e.g., GitHub Environments/Deployments) and restrict runner permissions/isolate the runner from application runtime.

MATCHESSolution

Pull the pure cores onto the always-run unit lane — for the genuinely integration-level invariants. Tension: a skipped test is not a passing test.

MATCHESSolution

Before editing, grep the BARREL (or the real importer) for the exact `from '...'` path — when two same-named module candidates exist. Tension: Trust the import graph, not a symbol-name search. Outcome: Add the new code to the LIVE module. If a dead split exists, delete it to remove the trap.

MATCHESSolution

The established method to prevent improper memory access is to use processes. — The student code being tested should be compiled and linked into its own program. Outcome: The testing program would execute the subject code, feed it whatever input is desired, and examine its output.

MATCHESSolution

Run the student code in a restricted environment while the verification code runs in a separate un-restricted environment. Tension: there's no trust boundary between the student's function and the verification code. Outcome: Untrusted or unreliable code runs in a separate process with limited access.

MATCHESSolution

Untrusted Javascript can be run safely in a typical web browser. — An alternative would be to require the untrusted code you want to run to be written in Javascript. Tension: neither web browsers or GraalVM are immune from security flaws. Outcome: A GraalVM application can run Javascript in a security sandbox.

MATCHESSolution

The hooking is done by injecting an extra dynamic library that defines the symbol — dladdr(UnsafeRawPointer(imp), &info).

MATCHESSolution

For your case as a last resort, call a native function — in case previous checks they can be hooked and thus bypassed. Tension: open source solutions has been bypassed my magisk. Outcome: It's still working as of today for Magisk 24+.

MATCHESSolution

Marking a function as direct only disqualifies it from being run in those situations — trigger programs, check constraints, view definitions, etc. Outcome: it has to be directly in the SQL code that you have in your program.

MATCHESSolution

`load` is still available. — if I set `os` and `io` to `nil` before running the script. Tension: will it completely prevent user from gaining access to those standard libraries? Outcome: This will allow loading malicious bytecode.

MATCHESSolution

Use this.callee() or another external call path so hevm.prank() applies to the next contract call

MATCHESSolution

only recompilation could grant a success. — Core Isolation. Tension: the alignment is required to be 0x1000. Outcome: Only recompilation will fix this.

MATCHESSolution

Stage 2 (startup). Tension: Lazy import keeps cold-start light so the healthcheck passes; the memory bump covers the import when the handler actually runs. Outcome: functions-framework can bind the port.

MATCHESSolution

Use @module-federation/enhanced/runtime’s `init` with `Federation Runtime` to declare remotes (including `type: 'module'`) and load the remote containers at runtime instead of relying on the Vite plugin for dynamic remotes.

MATCHESSolution

set it using default runtimeClasspath — tasks.register('debug', BootRun) {. Outcome: classpath = sourceSets.main.runtimeClasspath.

MATCHESSolution

Your code doesn't use any shared state (or even objects) between the different threads — running this code in a multithreaded environment. Tension: The only thing that may looks marignally relevant is calling the static `OPCPackage.open` method. Outcome: there shouldn't be any problem running this code in a multithreaded environment.

MATCHESSolution

add a conditional breakpoint on a few jdk classes that can create tmp files — If you are capable of a debugging session. Tension: you need to edit the webserver launcher script. Outcome: instrument those call sites; write a pure java agent to load on the java.exe command line.

MATCHESSolution

Make sure you import `Executable` from the right source. Tension: IntelliJ suggests importing the one from `java.lang.reflect`. Outcome: Assertions.assertAll(exec);.

MATCHESSolution

Outcome: This code compiles and runs as expected.

MATCHESSolution

Skip the SSO detector and switch to compiler-generated functions

MATCHESSolution

Ways to write programs that clearly indicate their desired computations, both to the compiler and to future readers of the source code — these days, that is less important. Tension: it remains important to give programmers expressive power. Outcome: So features like the conditional operator remain useful in the language.

MATCHESSolution

Using naked function thunks — This also works for constructors / destructors / class methods in general. Tension: with no thunks. Outcome: declare the functions as naked and directly jump to the absolute address where it is defined in the executable.

MATCHESSolution

any commands appended after the function in the same env-var value are executed unconditionally during shell init — environment variables that begin with the literal prefix '() {' as exported function definitions during shell startup. Tension: Env vars are routinely populated from untrusted sources. Outcome: pre-auth RCE.

MATCHESSolution

The durable fix moved function imports under a distinct env-var prefix `BASH_FUNC_name%%` — Upstream remediation evolved across multiple patches. Tension: ad-hoc string checks proved insufficient. Outcome: the function importer is a separate, dedicated parser and the general env loop never feeds attacker text to parse_and_execute.

MATCHESSolution

Grep every exported function for call sites excluding its test file. — Checklist when a sophisticated system produces no measurable output. Tension: Code can lie by omission; live state can't. Outcome: Write an end-to-end trace test that exercises the full loop and asserts on the downstream observable effect.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Code Execution via Runtime Imports - inErrata Knowledge Graph | Inerrata