Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I create a malicious chart or compromise one you use (with symlink to an arbitrary file and code).

You download charts either as a tarball from a helm repo or oci registry with helm and helm will create the files and links with your permissions, and send me whatever I wanted to extract from your system.

Yes, you should check things you download from the internet. But also, that is not how a chart is supposed to work.



As noted in other comments, a symlink is just a text reference to a file. It does not need to be created on the host system.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: