3 ms·

It's funny how many of the security vulnerabilities you always hear about (including to some degree the recent log4j vulnerability) are to do with incorrectly e

It's funny how many of the security vulnerabilities you always hear about (including to some degree the recent log4j vulnerability) are to do with incorrectly escaping inputs when generating a string in another language. This is so basic; why do people keep getting it wrong?

tome 5y ago
Because most programming languages make it very hard to correctly model data, for example, they lack sum types/discriminated unions.
tsimionescu 5y ago
Because it's very very hard to "correctly" escape strings you don't control, and it's probably an undecidable problem in the general case. From my point of view, any API which accepts special strings from users is a massive burden and should be extremely suspect when used in an automatic fashion. Sure, the shell is nice when you're interacting with it, but calling the shell from your own program is crazy. Similarly, the fact that databases don't offer any structured query fomat and insist on plain text SQL (even with the kludge of prepared statements) is a horrible idea, that has bit everyone time and time again.
- mgaunard 5y ago
  It's not hard at all. The target programming language has a well-defined grammar that says which special characters need to be escaped in strings, and a mechanism to do so, be that in the case of SQL, sh or printf formatters. Not doing it is just plain incompetence.
  - tsimionescu 5y ago
    It's only easy if you want to escape everything. If there is any intention to mix escaped and unescaped text, it becomes much more difficult.
    - mgaunard 5y ago
      No it isn't. You just need to formally specify what you want to happen, then reason as to whether this leads to adequate semantics for the component being built, and iterate until satisfactory semantics are achieved. This just happens to be the definition of programming.

3 ms·

It's funny how many of the security vulnerabilities you always hear about (including to some degree the recent log4j vulnerability) are to do with incorrectly e

by mgaunard 5y ago

tome 5y ago
Because most programming languages make it very hard to correctly model data, for example, they lack sum types/discriminated unions.
tsimionescu 5y ago
Because it's very very hard to "correctly" escape strings you don't control, and it's probably an undecidable problem in the general case. From my point of view, any API which accepts special strings from users is a massive burden and should be extremely suspect when used in an automatic fashion. Sure, the shell is nice when you're interacting with it, but calling the shell from your own program is crazy. Similarly, the fact that databases don't offer any structured query fomat and insist on plain text SQL (even with the kludge of prepared statements) is a horrible idea, that has bit everyone time and time again.
- mgaunard 5y ago
  It's not hard at all. The target programming language has a well-defined grammar that says which special characters need to be escaped in strings, and a mechanism to do so, be that in the case of SQL, sh or printf formatters. Not doing it is just plain incompetence.
  - tsimionescu 5y ago
    It's only easy if you want to escape everything. If there is any intention to mix escaped and unescaped text, it becomes much more difficult.
    - mgaunard 5y ago
      No it isn't. You just need to formally specify what you want to happen, then reason as to whether this leads to adequate semantics for the component being built, and iterate until satisfactory semantics are achieved. This just happens to be the definition of programming.