Exploit unlocking reassignment for any protected object
- Dominant language
- Macaulay2
- Stars
- 435
- Forks
- 297
- Avg merge
- 4d 20h
- Merged PRs (30d)
- 11
Description
I've found a funny bug that removes the protection guard from arbitrary object
```macaulay2
Macaulay2, version 1.26.06-2-g1a37f6fe95-dirty (makepkg)
Type "help" to see useful commands
i1 : H >> Thing := 196883
stdio:1:5:(3):[1]: error: no method for binary operator >> applied to objects:
List (of class Type)
>> 196883 (of class ZZ)
i2 : << Thing + 1|" = "|Thing|" + 1";
196884 = 196883 + 1
```
This probably caused by the low precedence of `>>` causing the execution to go in the reversed order, including runtime errors handlers.
The minimal code making it work that I've found is: `H>>pi:=3`, and the pattern seems to work on any objects - regardless of it being protected or not, the assignment from rhs gets always executed, here causing the biggest engineers' dream to come true:
```macaulay2
i1 : H>>pi:=3
stdio:1:1:(3):[1]: error: no method for binary operator >> applied to objects:
H (of class Symbol)
>> 3 (of class ZZ)
i2 : pi == 3
o2 = true
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Begin with the minimal reproducer H>>pi:=3 and compare its behavior with the reported runtime error and subsequent pi == 3 result. Trace parsing and operator-precedence handling for >>, including error paths, then add a regression test showing that a failed reassignment cannot modify protected or arbitrary objects.
Written by the indexing model from the issue text.
Assessment
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100