4 ms·

Perl's taint checking really was ahead of its time (introduced in 1988, according to Wikipedia!) Are there other languages that have this feature? (wiki only m

Perl's taint checking really was ahead of its time (introduced in 1988, according to Wikipedia!) Are there other languages that have this feature? (wiki only mentions Ruby)

pmarin 11y ago
Tcl has a safe interpreter mode https://www.tcl.tk/man/tcl/TclCmd/safe.htm https://www.tcl.tk/man/tcl/TclCmd/safe.htm
jameshart 11y ago
Taint checking offers a false sense of safety. Sure, data that originates in a request is unsafe, but does that means data retrieved from storage is safe? The right thing to do is to move away from plain string concatenation/interpolation: don't build dynamic SQL, don't hack together strings into JavaScript or HTML - use smart, format-aware templating tools (like golang's HTML templates) and parameterization.
- joosters 11y ago
  Data read from files is also tainted. I disagree with the 'false sense of security' as well - just like every other security feature from any system or technique you care to name, taint checking improves security but makes absolutely no claim that it magically makes your code completely secure.
lmm 11y ago
In a language with a modern type system it doesn't need to be a language-level feature. I use Scala and any use of unadorned String will be picked up in code review, because generally we prefer to use some specific type that says what it represents.
- jfoutz 11y ago
  It's amusing the solution you present is code review. I'd bet naked strings never get that far, because your business libraries all expect CustomerName or whatever.
  - lmm 11y ago
    Sure, but occasionally new programmers will do a bunch of work with a String and and only wrap it as a CustomerName before making a library call.
nightcracker 11y ago
World of Warcraft's addon system uses a taint system to keep certain actions in the UI secure. It uses Lua, but I don't believe the taint system is available by default in Lua.

Perl's taint checking really was ahead of its time (introduced in 1988, according to Wikipedia!) Are there other languages that have this feature? (wiki only mentions Ruby)

pmarin 11y ago

Tcl has a safe interpreter mode https://www.tcl.tk/man/tcl/TclCmd/safe.htm https://www.tcl.tk/man/tcl/TclCmd/safe.htm

jameshart 11y ago

Taint checking offers a false sense of safety. Sure, data that originates in a request is unsafe, but does that means data retrieved from storage is safe? The right thing to do is to move away from plain string concatenation/interpolation: don't build dynamic SQL, don't hack together strings into JavaScript or HTML - use smart, format-aware templating tools (like golang's HTML templates) and parameterization.

joosters 11y ago
Data read from files is also tainted. I disagree with the 'false sense of security' as well - just like every other security feature from any system or technique you care to name, taint checking improves security but makes absolutely no claim that it magically makes your code completely secure.

lmm 11y ago

In a language with a modern type system it doesn't need to be a language-level feature. I use Scala and any use of unadorned String will be picked up in code review, because generally we prefer to use some specific type that says what it represents.

jfoutz 11y ago
It's amusing the solution you present is code review. I'd bet naked strings never get that far, because your business libraries all expect CustomerName or whatever.
- lmm 11y ago
  Sure, but occasionally new programmers will do a bunch of work with a String and and only wrap it as a CustomerName before making a library call.

nightcracker 11y ago

World of Warcraft's addon system uses a taint system to keep certain actions in the UI secure. It uses Lua, but I don't believe the taint system is available by default in Lua.