redaxmedia/redaxscript — pull request #140 by larsborn (2014-05-18 12:26:09+00:00)
Title: do not allow execution of forbiddenFunctions if they are encoded as json

It was possible to execute functions like "exec" if you encode the function as json. For example:

{"exec":["ls"]}

I would also recommend to whitelist the allowed functions than to blacklist the forbidden ones. What do you think?