2 ms·
When you speak of “parsing untrusted data”, do you mean to imply that “parsing trusted data” even exists? I for one would view any and all input as untrusted.
by tempodox 9y ago
When you speak of “parsing untrusted data”, do you mean to imply that “parsing trusted data” even exists? I for one would view any and all input as untrusted.
- moosingin3space 9y ago"Trusted data" can exist in theory -- on a closed network where you control all endpoints -- but does not exist in practice (as many devices eventually connect to the Internet or exchange data with Internet-connected computers). Therefore, it follows that re-writing parsers in memory-safe languages would provide a nice bang-for-buck.
- TheCoelacanth 9y agoIn some cases, say the parser for an interpreter for a general purpose programming language, I would consider the data "trusted". You are already allowing execution of arbitrary code, so there is nothing to be gained by exploiting the parser.