舊文重貼:
2020年7月5日 ·
【我如何運用法律與經濟學在投資決策:營業中斷保險】
2004年左右我就曾為文記錄如何從消費者保護法中的「科技抗辯(state of art)」判斷當年因止痛藥Vioxx瑕疵陷入集體訴訟法律風險、股價腰斬的默克藥廠,其實真正面臨的風險並不高,並大膽$26美元危機入市,兩年半後$50多美元陸續獲利了結。
這部份可以參考後來2018年寫得更清楚的【效率市場假說是錯誤的】一文。
這是一次靠法律專業知識的價值投資操作。
近日因Covid-19在美國失控的疫情,我們又看到新一波影響更廣的法律爭議浮出抬面:營業中斷(business interruption)。
美國各州政府的封城(lockdown)措施使得許多中小企業面臨無法營業、營收中斷、現金流鎖死的倒閉危機。原本這些中小企業購買的商業保險,幾乎都有「營業中斷條款」,此條款大概涵蓋範疇如下(以Allstate公司為例):
1. 預期收入損失(For lost income from the destroyed merchandise (minus expenses you may have already paid, such as shipping).Your pre-loss earnings are the basis for reimbursement under business interruption coverage. Lost earnings, also known as the actual loss sustained, are typically defined as revenues minus ongoing expenses. )
2. 額外支出( For extra expenses if you must temporarily relocate your business because of the fire (for example, the cost of rent at the temporary location).)
然而近日上百萬家申請保險賠償的中小企業卻遭到保險公司拒付,理由是:「Covid-19疫情並未造成實質物理損失(actual physical loss)」。
什麼?賠到當內褲還叫沒有損失?這是怎麼一回事?
一、美國商業保險營業中斷(business interruption)條款法律爭議
多數保險公司紛紛於近日在各自網站上強調「實質物理損失(actual physical loss)的存在是申請保險支付的先決條件」。實質物理損失在保險公司方面的定義為:真實損害(damage)造成營業設備、不動產失去部分或全部原本功能/效用,造成商業收入損失。
換言之,目前美國保險公司的態度是 -- 病毒並未造成中小企業保戶物理上營業設備或不動產失去運作能力,病毒讓人致病又不讓機器廠房店面生病,當然不構成支付賠償金的條件。
中小企業主的立場顯然相反 -- 病毒與政府封城措施造成營業上之不可能,我當初買保險不正是為了這種不可預期之風險?沒了收入但租金、工資與各項支出依然照付,損失哪裡不真實不存在?
為何保險公司可以如此狹隘限縮解釋?這是因為此類商業保險的營業中斷條款最早源自於美國南北內戰時期,當時的商家因戰爭破壞或徵調的關係,其所擁有的商業設備或店面因此不再能持續生產失去收入,在此侷限條件下商界所應運而生的保險制度。故,美國保險法律與習慣上,對實質物理損失的看法是有歷史累積,而因循前例恰恰是普通法(common law)的核心邏輯。
可是現代世界與南北戰爭相差100多年,難道法律上都沒有可以擴張或改變的突破口?
有的,而此問題的法律突破口在一個我想台灣讀者大概都想不到的關鍵點 -- 「附著與污染」。
⟪附著與污染⟫
附著概念在1980、1990年代都已經有州法院判決提供了初步概念,但最標誌性、最多後來者引用的則是2002年康乃迪克州聯邦地方法院的⟪Yale University v. CIGNA Ins. Co.⟫一案。
此案中耶魯大學於1980年代的建築外牆塗漆後來證實含有重金屬鉛與石棉,造成第三人健康受損。耶魯大學根據產物保險條款,要求保險公司支付賠償金。保險公司稱:「塗漆又不影響建築物原本功用,不構成物理性實質損害。」拒絕賠償。
官司先在康乃迪克州州法院打,州法院也是採取與保險公司相同的限縮解釋。
但後來官司打到聯邦地方法院,聯邦地院卻採取擴張解釋:「附著」於耶魯大學建築物上的油漆,實質上「污染(contaminated)」了建築物,使其一部或全部失去了原本功用,因此構成實質物理損害。
此觀點在2009年也於⟪Essex Ins. Co. v. BloomSouth Flooring Corp.⟫案得到位於麻州的聯邦第一巡迴法院支持,認為附著於財產上的「惡臭(odor)」也是種能造成實質物理損害的汙染。
這也是為什麼目前我們看到針對Covid-19相關幾百個保險訴訟案中,最活躍的佛羅里達州律師John Houghtaling II主張:「『附著』於建築物、商業設施表面的冠狀病毒也是一種造成實質物理損害的汙染」。即便事實上多數公衛專家均指出目前科學證據顯示,Covid-19主要還是透過人傳人機制傳染,透過附著物體表面傳染案例屬於極少數特例。
因為熟悉英美法的人都知道,common law的先例是一個比較可能勝訴的框架,律師多盡量把訴之主張想辦法塞進成功框架裡,即便看起來很彆扭。要是跳脫既有框架另創新法律見解,則勝訴機率很可能大減。
但前述「附著與污染」見解並非每個法院都買單,例如紐約州州法院在2002年與2014年不同判決中都否定此擴張見解,堅持南北戰爭留下的狹義解釋。
可這就進入我們第二個重點...
二、經濟學角度切入:
各州法院之間對於營業中斷(business interruption)的法律定義不同勢必會增加各州中小企業與保險公司各自在營運上的不確定性。當然,這也會增加再保險公司的不確定性。
依據美國法架構,各州法律見解不同牽涉到跨州商務,是有高度可能最後進入聯邦最高法院以求一統一見解。然而法律訴訟程序的曠日廢時將使得中小企業不見得有足夠資金支撐到訴訟結果,但反之,希冀減少損失的保險公司們卻有相當高誘因要把戰場拖到最高法院。
從經濟學競爭(competitiveness)的概念切入,中小企業方也必將嘗試繞過既有遊戲規則,即法律程序,試圖建立有利於自己的新遊戲規則。
於是乎我們就見到美國知名四大主廚--Daniel Boulud (米其林兩顆星), Thomas Keller(米其林三顆星), Wolfgang Puck(米其林一顆星) 以及 Jean-Georges Vongerichten(米其林三顆星)-- 結盟,並於今年3月底去電美國總統川普,要求逼迫保險公司支付停業的商業損失。
川普果然也在4月份內部會議上提出:「他知悉保險公司對多年支付保費的餐廳業者雨天收傘一事,雖然他也知道保險公司保單涵蓋範圍有限,但如果支付賠償金是公平的,則保險公司就應該支付。(... saying restaurateurs had told him they paid for business-interruption coverage for decades but now they need it and insurers don’t want to pay. He said he understood that some policies have pandemic exclusions, adding: “I would like to see the insurance companies pay if they need to pay, if it’s fair.)」
熟悉制度經濟學的朋友都知道,當「無主收入」出現時,意味著租值消散(rent dissipation),也代表著整體社會的浪費。租值消散是整個經濟學最難掌握的高級概念,許多有名的經濟學家或教授,甚至某些諾貝爾獎得主,也不見得能正確理解並掌握此概念,本文並不打算詳談,請有興趣的讀者自行參考我過去幾篇舊文。
就我所知,一般經濟學者未曾討論「準租值消散(rent dissipation on depend)」狀況 -- 在法律定義未由最高法院統一見解前,被保險人無從得知是否可以取得保險賠償金;保險人雖暫時對保費有所有權,但一旦訴訟發生依會計原則也必須劃出一部分作為賠償準備金。可是在真實世界,我們目前不存在比曠日廢時的司法或所費不貲的政治遊說(包含政治獻金/賄絡),更有效率且廣為接受的制度來安排這樣的權利衝突。
(此處on depend概念類同於英美財產法中的on depend概念,我就不岔題解釋)
這是說,從經濟分析角度看,在統一法律見解未出現前,此狀況是一種社會費用,以租值消散形式暫時存在。
這就轉到本文的第三個重點,身為證券市場投資人,怎麼看怎麼應對?
三、投資人角度
在日常法律爭議上,此類「未有最終判決前,權利範圍或收入歸屬處於未定狀態」的狀況實屬常見。換個角度說,其實這些案件多屬於個體性風險,即便在系統內會產生一定權利範圍/未來收入預期影響,可幾乎都不會構成「系統性風險」。
但此次對「營業中斷」定義爭議卻碰上歷史罕見的大規模被迫停業狀況,根據美國普查局 (United States Census Bureau)的資料顯示,截至今年5月8日,因被迫停業而申請Paycheck Protection Program (PPP)的中小企業高達360萬家,借款金額達$5370億美元。4月26日~5月2日該週資料更是超過51.4%企業受到疫情影響(見圖)。
有保險公司代表說得清楚:保險原理是基於「大數法則」,亦即平時由多數人分別出資一小部分,於個別性風險實現時支付賠償金彌補其風險。但若「近乎所有出資者的風險都實現」,保險公司根本不可能同時支付所有被保險人賠償金,這已經不是個別性風險而是系統性風險,保險公司只能宣告破產。
2008年金融風暴主因之一也是原本以為透過大數法則建立的CDOs,包裹大量不同債信的房貸債權很安全,結果不堪系統性風險實現而崩潰。
我在今年五月份【美國失業人數破2千萬為何股市上漲?再來怎麼看?】一文中特別強調我們應該多關注CLOs(Collateralized Loan Obligation)潛在違約危機,也是著眼於此類別個別性風險轉為系統性風險的可能性激增。
同樣的,前述營業中斷保險條款無論美國法院最終見解為何,都很可能發生二選一結果:「大規模中小企業因封城出現流動性枯竭引發的大規模倒閉風險」對上「保險公司支付如此大量賠償金恐陷大規模財務危機」。
即便是繞過法律程序,透過政治遊說施壓美國行政單位,依然繞不開上述兩項風險必然實現其中一種的局面。
根據富國銀行(Wells Fargo)的推估,美國目前含有營業中斷條款的保險金額約$8千億美元,其中50%透過再保險方式轉嫁。值得慶幸的是我並未查到此類保險有轉化為其他衍生性金融商品,這表示風險可能未如CDO、CLO般倍數放大。富國銀行認為美國商業保險公司應該有能力吸收$1500億左右的賠償,但根據美國普查局資料受影響商家超過5成,意味著假設$4千億索賠發生時,即便能移轉$2千億至再保險公司,依然還有約$500億的差額。
我們要特別注意的是保險公司收到保險金後必須轉為投資方能獲利,這表示當股市下挫時保險公司的資產也會跟著縮水,償付能力也會隨之下降。例如巴菲特的Berkshire Hathaway旗下保險集團於今年第一季因支付保險賠償金淨損$4.89億美元,但同時集團資產卻也記入$550億資產減損。
故,我前述二擇一風險實現時,會不會引發股市下挫傷害保險公司資產也值得注意。
另一方面,有誘因把法律戰拖到聯邦最高法院的保險公司即便此策略成功執行,流動性短缺的中小企業恐怕提早實現第一種風險,對整體經濟乃至於股市同樣不利。
身為投資人還要再小心的,是本屆Fed主席Jerome H. Powell屢破歷史紀錄的灑鈔救市風格,也很可能在前述因保險爭議而生之系統性風險可能實現時再度開啟瘋狂印鈔機制,而在經濟學上會有什麼效果,我在【美國失業人數破2千萬為何股市上漲?再來怎麼看?】一文已經講得清楚,簡言之:
a. 證券資產價格將局部出現嚴重通貨膨脹。尤其這段時間持有美國資產者獲利率可能超越持有其他國家資產者。
b. 各國因貨幣政策多少掛著美元,而將出現輸入性通膨。
c. 寬鬆貨幣產生的貨幣幻覺(money illusion)將埋下更多錯誤投資地雷。
d. 每次寬鬆貨幣救市都是以美元地位為代價。當美元地位跌破均衡點,人民幣等主要貨幣不再支撐美元,美國將出現全面性嚴重通貨膨脹,美國債券價格將大跌,許多州政府、市政府有破產可能。此時,持有美元與美國境內資產者恐受相當傷害。
結論:
我批評過很多次,坊間常見的「價值投資」多半只是拿幾個財務數字挪來搬去,從嚴謹的經濟學角度看這只是看圖說故事的自我欺騙行為。我認為真正有效的價值投資,是依據如經濟學這類具備科學解釋力的理論架構,蒐集真實世界的關鍵侷限條件與條件轉變從而預測未來,並嘗試從中獲利。
掌握真實世界的關鍵侷限條件必須:a. 累積大量、多範圍的各種知識,其中法學、經濟學、基礎物理/化學/醫學乃至於某些工程實務等都是必須;與b. 有足夠的能力從無數侷限條件中分離出「關鍵」。
我也談過,Benjamin Graham以降至巴菲特的傳統價值投資法最大缺失在於「忽略貨幣因素」,一旦出現極端貨幣現象時,價值投資幾乎失效。這部份價值投資者必須自行強攻以價格理論出發的貨幣學來彌補。
巴菲特老夥伴Charlie Munger認為投資者需具備各種不同知識體系,吾人深以為然。此文為一又牛刀小試。
參考資料:
✤ Yale University v. CIGNA Ins. Co., 224 F. Supp. 2d 402 (D. Conn. 2002)
✤ Matzner v. Seaco Ins. Co., 1998 WL 566658 (Mass. Super. Aug. 12, 1998)
✤ Arbeiter v. Cambridge Mut. Fire Ins. Co., 1996 WL 1250616, at *2 (Mass. Super. Mar. 15, 1996)
✤ Essex Ins. Co. v. BloomSouth Flooring Corp., 562 F.3d 399, 406 (1st Cir. 2009)
✤ Roundabout Theatre Co. v. Cont’l Cas. Co., 302 A.D. 2d 1, 2 (N.Y. App. Ct. 2002)
✤ Newman, Myers, Kreines, Gross, Harris, P.C. v. Great N. Ins. Co., 17 F. Supp. 3d 323 (S.D.N.Y. 2014)
✤ The Wall Street Journal, "Companies Hit by Covid-19 Want Insurance Payouts. Insurers Say No." June 30, 2020
✤ Steven N.S. Cheung, "A Theory of Price Control," The Journal of Law and Economics, Vol. XVII, April 1974, pp. 53-71
✤ Willam H. Meckling & Armen A. Alchian, "Incentives in The United States," American Economic Review 50 (May 1960), pp. 55-61
✤ Milton Friedman, "Money and the Stock Market," Journal of Political Economy, 1988, Vol. 96, no. 2
✤ Irving Fisher, "The Money Illusion," 1928
文章連結
https://bit.ly/3gsJK6l
c program example 在 唐家婕 - Jane Tang Facebook 的最讚貼文
Breaking‼️
美東時間1月5日傍晚,川普以國家安全為由,用行政命令方式禁止阿里支付寶、微信支付、QQ錢包在內的8款中國應用程式(App)。
行政命令發佈後45天,禁止任何人與實體與這8款中國應用程式(App)進行交易。
按照日程,美國下任政府將在15天後,1月20日上任。
—
美國商務部長在同一時間發聲明表示,已指示商務部按行政命令執行禁令,「支持川普總統保護美國人民隱私與安全,免於受到中國共產黨的威脅。」
—
▫️8款App:
支付寶(Alipay)、掃描全能王(CamScanner)、QQ錢包(QQ Wallet)、茄子快傳(SHAREit)、騰訊QQ(Tencent QQ)、阿里巴巴旗下海外短視頻應用VMate、微信支付(WeChat Pay)和辦公型App WPS Office。
圖三:美國商務部聲明
圖四:美國國安顧問聲明
—
▫️白宮行政命令全文:
The White House
Office of the Press Secretary
FOR IMMEDIATE RELEASE
January 5, 2021
EXECUTIVE ORDER
- - - - - - -
ADDRESSING THE THREAT POSED BY APPLICATIONS AND OTHER SOFTWARE DEVELOPED OR CONTROLLED BY CHINESE COMPANIES
By the authority vested in me as President by the Constitution and the laws of the United States of America, including the International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.) (IEEPA), the National Emergencies Act (50 U.S.C. 1601 et seq.), and section 301 of title 3, United States Code,
I, DONALD J. TRUMP, President of the United States of America, find that additional steps must be taken to deal with the national emergency with respect to the information and communications technology and services supply chain declared in Executive Order 13873 of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain). Specifically, the pace and pervasiveness of the spread in the United States of certain connected mobile and desktop applications and other software developed or controlled by persons in the People's Republic of China, to include Hong Kong and Macau (China), continue to threaten the national security, foreign policy, and economy of the United States. At this time, action must be taken to address the threat posed by these Chinese connected software applications.
By accessing personal electronic devices such as smartphones, tablets, and computers, Chinese connected software applications can access and capture vast swaths of information from users, including sensitive personally identifiable information and private information. This data collection threatens to provide the Government of the People's Republic of China (PRC) and the Chinese Communist Party (CCP) with access to Americans' personal and proprietary information -- which would permit China to track the locations of Federal employees and contractors, and build dossiers of personal information.
The continuing activity of the PRC and the CCP to steal or otherwise obtain United States persons' data makes clear that there is an intent to use bulk data collection to advance China's economic and national security agenda. For example, the 2014 cyber intrusions of the Office of Personnel Management of security clearance records of more than 21 million people were orchestrated by Chinese agents. In 2015, a Chinese hacking group breached the United States health insurance company Anthem, affecting more than 78 million Americans. And the Department of Justice indicted members of the Chinese military for the 2017 Equifax cyber intrusion that compromised the personal information of almost half of all Americans.
In light of these risks, many executive departments and agencies (agencies) have prohibited the use of Chinese connected software applications and other dangerous software on Federal Government computers and mobile phones. These prohibitions, however, are not enough given the nature of the threat from Chinese connected software applications. In fact, the Government of India has banned the use of more than 200 Chinese connected software applications throughout the country; in a statement, India's Ministry of Electronics and Information Technology asserted that the applications were "stealing and surreptitiously transmitting users' data in an unauthorized manner to servers which have locations outside India."
The United States has assessed that a number of Chinese connected software applications automatically capture vast swaths of information from millions of users in the United States, including sensitive personally identifiable information and private information, which would allow the PRC and CCP access to Americans' personal and proprietary information.
The United States must take aggressive action against those who develop or control Chinese connected software applications to protect our national security.
Accordingly, I hereby order:
Section 1. (a) The following actions shall be prohibited beginning 45 days after the date of this order, to the extent permitted under applicable law: any transaction by any person, or with respect to any property, subject to the jurisdiction of the United States, with persons that develop or control the following Chinese connected software applications, or with their subsidiaries, as those transactions and persons are identified by the Secretary of Commerce (Secretary) under subsection (e) of this section: Alipay, CamScanner, QQ Wallet, SHAREit, Tencent QQ, VMate, WeChat Pay, and WPS Office.
(b) The Secretary is directed to continue to evaluate Chinese connected software applications that may pose an unacceptable risk to the national security, foreign policy, or economy of the United States, and to take appropriate action in accordance with Executive Order 13873.
(c) Not later than 45 days after the date of this order, the Secretary, in consultation with the Attorney General and the Director of National Intelligence, shall provide a report to the Assistant to the President for National Security Affairs with recommendations to prevent the sale or transfer of United States user data to, or access of such data by, foreign adversaries, including through the establishment of regulations and policies to identify, control, and license the export of such data.
(d) The prohibitions in subsection (a) of this section apply except to the extent provided by statutes, or in regulations, orders, directives, or licenses that may be issued pursuant to this order, and notwithstanding any contract entered into or any license or permit granted before the date of this order.
(e) Not earlier than 45 days after the date of this order, the Secretary shall identify the transactions and persons that develop or control the Chinese connected software applications subject to subsection (a) of this section.
Sec. 2. (a) Any transaction by a United States person or within the United States that evades or avoids, has the purpose of evading or avoiding, causes a violation of, or attempts to violate the prohibition set forth in this order is prohibited.
(b) Any conspiracy formed to violate any of the prohibitions set forth in this order is prohibited.
Sec. 3. For the purposes of this order:
(a) the term "connected software application" means software, a software program, or group of software programs, designed to be used by an end user on an end-point computing device and designed to collect, process, or transmit data via the Internet as an integral part of its functionality.
(b) the term "entity" means a government or instrumentality of such government, partnership, association, trust, joint venture, corporation, group, subgroup, or other organization, including an international organization;
(c) the term "person" means an individual or entity;
(d) the term "personally identifiable information" (PII) is information that, when used alone or with other relevant data, can identify an individual. PII may contain direct identifiers (e.g., passport information) that can identify a person uniquely, or quasi-identifiers (e.g., race) that can be combined with other quasi-identifiers (e.g., date of birth) to successfully recognize an individual.
(e) the term "United States person" means any United States citizen, permanent resident alien, entity organized under the laws of the United States or any jurisdiction within the United States (including foreign branches), or any person in the United States.
Sec. 4. (a) The Secretary, in consultation with the Secretary of the Treasury and the Attorney General, is hereby authorized to take such actions, including adopting rules and regulations, and to employ all powers granted to me by IEEPA, as may be necessary to implement this order. All agencies shall take all appropriate measures within their authority to implement this order.
(b) The heads of agencies shall provide, in their discretion and to the extent permitted by law, such resources, information, and assistance to the Department of Commerce as required to implement this order, including the assignment of staff to the Department of Commerce to perform the duties described in this order.
Sec. 5. Severability. If any provision of this order, or the application of any provision to any person or circumstance, is held to be invalid, the remainder of this order and the application of its other provisions to any other persons or circumstances shall not be affected thereby.
Sec. 6. General Provisions. (a) Nothing in this order shall be construed to impair or otherwise affect:
(i) the authority granted by law to an executive department, agency, or the head thereof; or
(ii) the functions of the Director of the Office of Management and Budget relating to budgetary, administrative, or legislative proposals.
(b) This order shall be implemented consistent with applicable law and subject to the availability of appropriations.
(c) This order is not intended to, and does not, create any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
DONALD J. TRUMP
THE WHITE HOUSE,
January 5, 2021.
c program example 在 โปรแกรมเมอร์ไทย Thai programmer Facebook 的精選貼文
👨🏫 ในรูปได้ยกตัวอย่าง ช่องโหว่ของการเขียนโปรแกรม
ที่เปิดโอกาสให้ผู้ประสงค์ร้ายสามารถโจมตีด้วยวิธี
Command Injection
.
ช่องโหว่นี้เกิดจากในหลายๆ ภาษาโปรแกรมมิ่ง
ได้อนุญาติให้เรียกคำสั่งของระบบปฏิบัติการได้โดยตรง
ซึ่งสุ่มเสี่ยงให้ผู้โจมตีฉวยโอกาสนี้ฉีดคำสั่งเข้าไปในโค้ด
ด้วยการต่อท้ายด้วยข้อความ &&
จึงทำให้แทรกคำสั่งอันตรายเข้าไปได้ เช่น
:
del /F * บน window
หรือ rm -rf * บน linux
:
ในรูปได้ยกตัวอย่างโค้ดภาษา Java
ซึ่งทำงานบน Window
จะเห็นว่าสามารถใช้ && แล้วต่อท้ายด้วยคำสั่งอะไรก็ได้
เช่น && tasklist && dir เป็นต้น
.
แล้วถ้าโปรแกรมมันรันใน linux/Unix
ก็สามารถต่อคำสั่งเป็นลูกโซ่ด้วยข้อความ && หรือ ; ก็ได้
:
และไม่ใช่ Java ภาษาเดียว ที่มีช่องโหว่ประเภทนี้
มันเกิดได้หลายภาษา
ที่อนุญาติให้เรียกคำสั่งของระบบปฏิการโดยตรง
เช่น C#, Python, PHP และหลายๆ ภาษาที่ไม่ได้เอ่ยถึง
:
++++วิธีป้องกัน+++
🤔 ต้อง validate ข้อมูล input อย่างเข้มงวด เช่น
- กรอง input ที่เข้ามา กำหนดว่ามีอะไรได้บ้าง?
- input ที่เข้ามา ห้ามเป็นคำสั่งของระบบปฏิบัติการเด็ดขาด
- ห้ามมี && และ ; อยู่ใน input ที่เข้ามา
- เป็นต้น
.
😏 หรือจะเลี่ยงวิธีเขียนเรียกคำสั่งของระบบปฏิบัติการโดยตรง ไม่ต้องใช้ก็ย่อมได้
++++
เขียนโดย โปรแกรมเมอร์ไทย thai programmer
.
ดูตัวอย่างเพิ่มเติม
https://www.owasp.org/index.php/Command_Injection
👨 🏫 In the photo, for example, the loophole of programming.
Open doors for the evil wills to attack by the way.
Command Injection
.
This loophole is born in many programming languages.
Permission to call direct order of operating system
Who randomly risked this opportunity attacker to inject an order into code.
By ending with a text &&
It's so dangerous to insert like
:
del / F F on window
or rm-rf rf on linux
:
In the picture, for example, Java language code.
Which works on Window
Will see that I can use && and then end up with any order.
Like && tasklist && dir etc.
.
And if the program runs in linux / Unix
Can continue with chain order with text && or; either.
:
And not Java the only language has this type of loophole
It can be born in many languages.
Allowing to call direct command of the operational system.
Like C #, Python, PHP and many languages that are not mentioned.
:
++++ How to prevent +++
🤔 Must strictly validate input information like
- Input filter that comes to determine what's available?
- Input that comes to prohibit is an order of an operating system.
- Don't have && and; stay input that comes.
- etc.
.
😏 or avoid the way to write, call direct command of an operating system. No need to use it.
++++
Written by Thai programmer thai coder
.
See more previews
https://www.owasp.org/index.php/Command_InjectionTranslated
c program example 在 C Programming examples with Output - BeginnersBook.com 的相關結果
C Programming examples with Output · 1. Hello World Program in C · 2. C program to check whether the given number is positive or negative · 3. Reverse an input ... ... <看更多>
c program example 在 100+ C Program examples with Output for practice 的相關結果
Program List → · Hello World · Taking Input from User · Find ASCII Value of Character · Using gets() function · If-Else · Switch Case · Checking for Vowel · Reversing ... ... <看更多>
c program example 在 C Examples | Programiz 的相關結果
Popular Examples · C "Hello, World!" · C Program to Print an Integer (Entered by the User) · C Program to Add Two Integers · C Program to Multiply Two Floating- ... ... <看更多>