4 ms·
Sure but just like a web browser, it’s the application’s responsibility to sandbox or verify the code, not the http library’s.
by empthought 6y ago
Sure but just like a web browser, it’s the application’s responsibility to sandbox or verify the code, not the http library’s.
- skrebbel 6y agoThat translates to "don't use SQLite", right? How would an application that uses SQLite as a file format be able to scan for malicious database files that trigger buffer overflows in the SQLite engine? I'm really not sure what you're suggesting.
- empthought 6y agoRTFM https://www.sqlite.org/security.html https://www.sqlite.org/security.html
- speedgoose 6y agoFrom the description, I didn't watch the video, loading the database and querying it is enough to run the exploit. To compare with your example, it would be like having a remote exploit if your application queries a specific http endpoint. For sure application developers could sandbox the http library, sqlite, or stop using libraries developed in so unsafe programming languages but it's a bit too early for that.