3 ms·

You are making a false equivalence—not all languages are equally busted. Any sanely designed modern language does not allow this to happen. Accidentally parsing

by pshc 5y ago

You are making a false equivalence—not all languages are equally busted. Any sanely designed modern language does not allow this to happen. Accidentally parsing a string you didn’t mean to parse is a fault of C’s outdated API design, a design flaw that keeps tripping people up again and again.

junon 5y ago
> Any sanely designed modern language does not allow this to happen Sorry, how does Rust protect you against injection again?
- pshc 5y ago
  Why would Rust do anything weird when presented with the string "%p%s%s%s%s%n"?
  - junon 5y ago
    Why would C?
    - pshc 5y ago
      Do you want the obvious explanation? Because the string was passed into the format string parameter of some sprintf-like, a common mistake in C usually caught by warnings but seemingly ignored or suppressed in this case. edit: turns out from the analysis it was CFStringCreateWithFormatAndArguments, so yes, a sprintf-like used incorrectly
      - junon 5y ago
        This is possible with any language. Not just C.
        melff 5y ago
        No, Rust for example explicitly disallows this. https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=49fd5d8fa05cbf4fb07bd9befbe016d2 https://play.rust-lang.org/?version=stable&mode=debug&editio...
        junon 5y ago
        You miss my point entirely.
        melff 5y ago
        What is your point then?
        junon 5y ago
        You can do this in any language. Rust doesn't support it with PrintLn but it's still possible with Rust. Stop acting like C did anything wrong.
- melff 5y ago
  By requiring format strings to be literals. https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=49fd5d8fa05cbf4fb07bd9befbe016d2 https://play.rust-lang.org/?version=stable&mode=debug&editio...