4 ms·

I'd just like to mention that perl, which is often underrated, has a "tainted" mode that checks at compile time that you sanitized all inputs, and refuse to run

by wazoox 15y ago

I'd just like to mention that perl, which is often underrated, has a "tainted" mode that checks at compile time that you sanitized all inputs, and refuse to run if it isn't the case: http://perldoc.perl.org/perlsec.html#SECURITY-MECHANISMS-AND-CONCERNS http://perldoc.perl.org/perlsec.html#SECURITY-MECHANISMS-AND...

masklinn 15y ago
> a "tainted" mode that checks at compile time that you sanitized all inputs Considering how dynamic perl is, and that you can mix tainted and non-tainted values in a single collection (for instance), I don't see how a perl program could be statically analyzed for taintedness misuses.
- jrockway 15y ago
  The program dies at runtime if the runtime detects a misuse of tainted data. The reality is that nobody uses taint mode, though, for whatever reason. If you look at my comment up the page, the problem that people have is not managing the safety of data, it's making sure that they present the right "view" of that data to the right component. HTML needs to be escaped, but not if it's already been escaped, and so on.
  - wazoox 15y ago
    > The reality is that nobody uses taint mode, though, for whatever reason. Uh? I do use it; it's extremely efficient. I'm probably not the only one :)
  - masklinn 15y ago
    > The program dies at runtime if the runtime detects a misuse of tainted data. Right, so it's not at compile time. Thank you.
joeyh 15y ago
I used to think that was pretty cool, until I realized it was probably developed well after Haskell. :) It can be of help if you're passing a lot of input to system() etc; it's not really general enough to help with web programming. I gave up on perl's taint mode when I discovered this bug http://bugs.debian.org/411786 http://bugs.debian.org/411786 , in which perl randomly sets the taint flag due to a utf8 bug.
- wazoox 15y ago
  Well, it's a bug. It's not supposed to happen, and AFAIK it occurs only for some (one?) specific version...
- JadeNB 15y ago
  According to Wikipedia, Haskell 1.0 was defined in 1990 (http://en.wikipedia.org/wiki/Haskell_%28programming_language%29#History http://en.wikipedia.org/wiki/Haskell_%28programming_language...), but Perl has had taint mode since v3 in 1989 (http://en.wikipedia.org/wiki/Taint_checking#History http://en.wikipedia.org/wiki/Taint_checking#History). Anyway, I'm not sure why it would be less cool even if it were inspired by another language (which I'm sure it was; Perl, like English, elevates borrowing to an art form).

by wazoox 15y ago

masklinn 15y ago

> a "tainted" mode that checks at compile time that you sanitized all inputs Considering how dynamic perl is, and that you can mix tainted and non-tainted values in a single collection (for instance), I don't see how a perl program could be statically analyzed for taintedness misuses.

jrockway 15y ago
The program dies at runtime if the runtime detects a misuse of tainted data. The reality is that nobody uses taint mode, though, for whatever reason. If you look at my comment up the page, the problem that people have is not managing the safety of data, it's making sure that they present the right "view" of that data to the right component. HTML needs to be escaped, but not if it's already been escaped, and so on.
- wazoox 15y ago
  > The reality is that nobody uses taint mode, though, for whatever reason. Uh? I do use it; it's extremely efficient. I'm probably not the only one :)
- masklinn 15y ago
  > The program dies at runtime if the runtime detects a misuse of tainted data. Right, so it's not at compile time. Thank you.

joeyh 15y ago

I used to think that was pretty cool, until I realized it was probably developed well after Haskell. :) It can be of help if you're passing a lot of input to system() etc; it's not really general enough to help with web programming. I gave up on perl's taint mode when I discovered this bug http://bugs.debian.org/411786 http://bugs.debian.org/411786 , in which perl randomly sets the taint flag due to a utf8 bug.

wazoox 15y ago
Well, it's a bug. It's not supposed to happen, and AFAIK it occurs only for some (one?) specific version...
JadeNB 15y ago
According to Wikipedia, Haskell 1.0 was defined in 1990 (http://en.wikipedia.org/wiki/Haskell_%28programming_language%29#History http://en.wikipedia.org/wiki/Haskell_%28programming_language...), but Perl has had taint mode since v3 in 1989 (http://en.wikipedia.org/wiki/Taint_checking#History http://en.wikipedia.org/wiki/Taint_checking#History). Anyway, I'm not sure why it would be less cool even if it were inspired by another language (which I'm sure it was; Perl, like English, elevates borrowing to an art form).