3 ms·
I think the main problem (don't know whether this is possible in Rust which I am not familiar with) is that untrusted input is passed around as strings at all (
by chopin 8y ago
I think the main problem (don't know whether this is possible in Rust which I am not familiar with) is that untrusted input is passed around as strings at all (Java, which I am familiar with, does this). I'd prefer:
- Getting untrusted input as a separate type
- Having only a controlled way to put instances of this type into an SQL query
- bluejekyll 8y agoYou pretty much just nailed exactly what this post is demonstrating about Rust. The lifetime associated with the different types indicates the provenance of the variables. Basically, the 'static lifetime guarantees that the query string was built at compile time. And then it allows the parameters to be from user input. To Rust, these are effectively different types due to the restrictions on the function definition, which restricts the first parameter to 'static, and the list of SQL parameters can come from anywhere (static or dynamic runtime).
- icebraining 8y agoYeah, but using "built at compile time" as a synonym for "safe" is pretty crude. A runtime string composed of the concatenation of two compiled strings is still safe, yet not allowed here.
- kbsletten 8y agoThat seems easy enough to fix, no? Change the API to allow a runtime generated list of compile-time strings, et viola. Though, I doubt that's as safe as you might imagine. Imagine a return oriented programming-like technique using static SQL strings. Difficult, for sure, but not impossible.
- yoklov 8y agoThis is doable in rust too.