5 ms·
Parsing unstruted strings without escaping special characters is an issue in any language. This is completely Apple's fault.
by m45t3r 5y ago
Parsing unstruted strings without escaping special characters is an issue in any language. This is completely Apple's fault.
- plantain 5y agoFunny how these faults keep happening over and over again in the same set of languages.
- m45t3r 5y agoI am pretty sure that I can have injection attacks from unsanatized user inputs in any language.
- melff 5y agoYes, but some languages (like my personal favorite Rust) make it practically impossible to happen with their equivalent of printf().
- dmitrygr 5y agoFunny how most car crashes are caused by humans driving.
- dylan604 5y agoWe've all been trained to sanitize user input, but the WiFi SSID isn't a user input string, so why should I need to sanitize it? --some poor dev wondering where their Twitterverse sympathy is
- scintill76 5y agoIn a better language than C, format string injection would be less likely to lead to arbitrary read/write/RCE. I'll admit I looked around before writing this and saw that Python's str.format() can be pretty bad. So let's say a reasonably constrained formatting language in a good runtime -- the attacker is limited in what they can see or control, and the formatter can see how many arguments were actually passed so it doesn't tromp off into other memory.
- pshc 5y agoYou are making a false equivalence—not all languages are equally busted. Any sanely designed modern language does not allow this to happen. Accidentally parsing a string you didn’t mean to parse is a fault of C’s outdated API design, a design flaw that keeps tripping people up again and again.
- junon 5y ago> Any sanely designed modern language does not allow this to happen Sorry, how does Rust protect you against injection again?
- pshc 5y agoWhy would Rust do anything weird when presented with the string "%p%s%s%s%s%n"?
- junon 5y agoWhy would C?
- pshc 5y agoDo you want the obvious explanation? Because the string was passed into the format string parameter of some sprintf-like, a common mistake in C usually caught by warnings but seemingly ignored or suppressed in this case. edit: turns out from the analysis it was CFStringCreateWithFormatAndArguments, so yes, a sprintf-like used incorrectly
- melff 5y agoIt's completely their fault either way. They are responsible for the technology they use. This nasty printf()-like way of formatting is a giant footgun though. Apple are not the first ones to fall into this trap.