Arbitrary code execution vulnerability

[wimleers]

                '#lazy_builder' => [
                    $request->get('callback'),
                    $request->get('args'),
                ]

means arbitrary code could be executed. For example $request->get('callback') === 'unlink' and $request->get('args') = ['~/.ssh/*'].

[wimleers]

Note that \Drupal\big_pipe\Render\Placeholder\BigPipeStrategy::generateBigPipePlaceholderId()'s result is purely informative; it's never used to determine which code to execute. Hence BigPipe does not suffer from the same security vulnerability.

[esolitos]

@ThijsFeryn Maybe you should add this disclaimer in the project readme, doesn't need to be fixed right now as this is a PoC module, but better alert any possible user!