* l’application s’exécute localement (par ex. sur `localhost`) ou sur un réseau interne
* et l’application n’a aucun mécanisme d’authentification, elle part du principe que toute requête provenant du même réseau est fiable.

## Exemple d’attaque { #example-attack }

Imaginez que vous mettiez au point un moyen d’exécuter un agent IA local.

Il expose une API à l’adresse

```
http://localhost:8000/v1/agents/multivac
```

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
          check-latest: true
      - name: Start root lockdown tests
        run: |

if [ $? -ne 0 ]; then
	echo "listing failed, 'minioadmin' should be enabled"
	exit 1
fi

killall -9 minio

rm -rf /tmp/multisitea/
rm -rf /tmp/multisiteb/

echo "Setup site-replication and then disable root credentials"

minio server --address 127.0.0.1:9001 "http://127.0.0.1:9001/tmp/multisitea/data/disterasure/xl{1...4}" \
	"http://127.0.0.1:9002/tmp/multisitea/data/disterasure/xl{5...8}" >/tmp/sitea_1.log 2>&1 &

    @Size(max = 1000)
    public String spnegoPreauthPassword;

    /** Enable or disable SPNEGO basic authentication. */
    @Size(max = 10)
    public String spnegoAllowBasic;

    /** Enable or disable SPNEGO unsecure basic authentication. */
    @Size(max = 10)
    public String spnegoAllowUnsecureBasic;

    /** Enable or disable SPNEGO NTLM prompt. */
    @Size(max = 10)
    public String spnegoPromptNtlm;

      --with-sysroot="/${TARGET}" \
      --disable-bootstrap \
      --disable-libmpx \
      --disable-libsanitizer \
      --disable-libunwind-exceptions \
      --disable-libunwind-exceptions \
      --disable-lto \
      --disable-multilib \
      --enable-__cxa_atexit \
      --enable-gnu-indirect-function \
      --enable-gnu-unique-object \
      --enable-initfini-array \
      --enable-languages="c,c++" \

			},
		},
		// Keys with spaces in between
		{
			input: `enable=on format=namespace connection_string=" host=localhost port=5432 dbname = cesnietor sslmode=disable" table=holicrayoli`,
			keys:  []string{"enable", "connection_string", "comment", "format", "table"},
			expectedFields: map[string]struct{}{
				`enable=on`:        {},
				`format=namespace`: {},

rem Use temp file approach with cmd /c to ensure proper file handle release

set "JVM_CONFIG_TEMP=%TEMP%\mvn-jvm-config-%RANDOM%-%RANDOM%.txt"

rem Debug logging (set MAVEN_DEBUG_SCRIPT=1 to enable)
if defined MAVEN_DEBUG_SCRIPT (
  echo [DEBUG] Found .mvn\jvm.config file at: %MAVEN_PROJECTBASEDIR%\.mvn\jvm.config
  echo [DEBUG] Using temp file: %JVM_CONFIG_TEMP%

odirect                         (boolean)   set to enable or disable O_DIRECT for writes under special conditions. NOTE: do not disable O_DIRECT without prior testing (default: 'on')
root_access                     (boolean)   turn 'off' root credential access for all API calls including s3, admin operations (default: 'on')
sync_events                     (boolean)   set to enable synchronous bucket notifications (default: 'off')

          echo "Directory $basedir extracted from the -f/--file command-line argument ${arg} does not exist" >&2
          exit 1
        fi
      else
        echo "POM file ${arg} specified with the -f/--file command line argument does not exist" >&2
        exit 1
      fi
      break
    fi
    if [ "$arg" = "-f" -o "$arg" = "--file" ]; then
      found_file_switch=1
    fi
  done
  echo "$basedir"

			Optional:    true,
			Type:        "duration",
		},
		config.HelpKV{
			Key:         apiODirect,
			Description: "set to enable or disable O_DIRECT for writes under special conditions. NOTE: do not disable O_DIRECT without prior testing" + defaultHelpPostfix(apiODirect),
			Optional:    true,
			Type:        "boolean",
		},
		config.HelpKV{
			Key:         apiRootAccess,