Run Code executes the client side rendered php

[gefd]

This is likely to be exploitable. The run code button should run the snippet from the serverside.

[damianwadley]

It's only exploitable if the page allows XSS and/or if there's a breach in the nature of WASM such that it could cause a problem in a user's browser or computer. Can you demonstrate that?

[gefd]

This is obviously a non-issue. I didn't dig deep enough initially to see that it's using php-wasm and assumed it was running server side :)

[damianwadley]

You're definitely right that it's not apparent how it works when you run one of the code examples. Good news is that problem is one of the reasons why I created php/doc-en#4353 earlier today - in fact, I found your report here while I was writing it up and looking for past Issues.