It's maybe worth to make a step back and take a new look at the underlying problem. Source code combines multiple kinds of text. There are * hierarchical stru

It's maybe worth to make a step back and take a new look at the underlying problem. Source code combines multiple kinds of text. There are * hierarchical structure, * mathematical and logical syntax * literals (especially insidious: text) * free text in comments and * markup in documentation These newly discovered vulnerabilities remind me of the issue of SQL injection, which is also caused by a confusion when combining these kinds of text. For SQL injection, the solution was to introduce facilities to explicitly combine SQL syntax and dynamic literals. Maybe we need something similar for code that enforces such strict separation. Maybe into different files or nested into a container format. There are already facilities for doing so (resource files, templating languages) but they are opt-in and don't go far enough to address the newly discovered problems. The cost would be that code could become more difficult to edit with plain-text editors.