5 ms·

Wow that's interesting. I've never heard of this in Perl or Ruby, and I always thought of taint analysis as static rather than dynamic. Though I don't have ex

by chubot 7y ago

Wow that's interesting. I've never heard of this in Perl or Ruby, and I always thought of taint analysis as static rather than dynamic. Though I don't have experience with it, maybe one reason it isn't used is because of false positives? For efficiency reasons, Perl takes a conservative view of whether data is tainted. If an expression contains tainted data, any subexpression may be considered tainted, even if the value of the subexpression is not itself affected by the tainted data. Has anyone used this? Is the runtime overhead always there, or only when you turn the taint mode on? It seems like it would have to occupy some extra space in the string objects all the time? (Although I guess if it's literally a single bit, it can come for "free" because of padding) ----- FWIW here are some references on static taint analysis: https://cacm.acm.org/magazines/2019/8/238344-scaling-static-analyses-at-facebook/fulltext https://cacm.acm.org/magazines/2019/8/238344-scaling-static-... cites https://www.usenix.org/legacy/event/sec06/tech/full_papers/xie/xie_html/ https://www.usenix.org/legacy/event/sec06/tech/full_papers/x...

tyingq 7y ago
"Has anyone used this?" Perhaps not much on purpose, but it kicks in automatically if the Perl script is setuid. So you'll find questions about it where people are struggling with it.
jandrese 7y ago
IIRC all CGI scripts were run with the taint checker on some systems.
UncleMeat 7y ago
Dynamic taint analysis is a really common technique in academic work, but largely has unacceptable performance costs for interesting applications. Typical costs range from 10% to 100% overhead or more. The other problem is that the entire system needs to track it. If you just own part of a system, instrumenting to add dynamic taint tracking can be really difficult.

5 ms·

Wow that's interesting. I've never heard of this in Perl or Ruby, and I always thought of taint analysis as static rather than dynamic. Though I don't have ex

by chubot 7y ago

tyingq 7y ago
"Has anyone used this?" Perhaps not much on purpose, but it kicks in automatically if the Perl script is setuid. So you'll find questions about it where people are struggling with it.
jandrese 7y ago
IIRC all CGI scripts were run with the taint checker on some systems.
UncleMeat 7y ago
Dynamic taint analysis is a really common technique in academic work, but largely has unacceptable performance costs for interesting applications. Typical costs range from 10% to 100% overhead or more. The other problem is that the entire system needs to track it. If you just own part of a system, instrumenting to add dynamic taint tracking can be really difficult.