They also apparently didn't do any input validation. This is why a faulty config was able to even trigger all of that.