Turbo-frames

[JoiRichi]

Good day guys. Kindly see this:
https://github.com/hotwire-django/turbo-lazy

[davish]

This looks great really awesome @JoiRichi! Something in line with what we were discussing in #5. I believe it's probably for the best to keep all the reusable components within the turbo-django repository. Would you mind opening a pull request with these additions so we could get them merged in?

[JoiRichi]

Ok, i will look it up. Cheers.

[blopker]

Just took a look at turbo-lazy, very cool! I think there's something there and could be more useful than just lifting the tag that the Rails repo has.

This can be fixed, but the biggest issue I see is the view code. Right now the lazy view is a vector for remote code execution since the token is just a b64 encoded JSON it can be controlled/manipulated by the client. Someone could call eval with any code they wanted. See https://github.com/hotwire-django/turbo-lazy/blob/main/turbo/lazy/views.py There needs to be a way for us to know only calls the developer intended are being made. This would normally be done by going through the URL machinery provided by Django. A little more boilerplate, but a lot more secure.

I don't mean to discourage you, but I think this is dangerous enough to not put it up for public consumption quite yet.

[blopker]

I tried the simplest thing to call eval with a token of {"view": "builtins.eval", "args": ["exit"], "kwargs": {}}, but passing request to the dynamic method call just made it return 500. So at this point it's not obvious to me that a full RCE is possible, but I'm still weary of letting the client call any function they want on the server.

[JoiRichi]

Can you make a small write up demonstration of this?