4 ms·
Is there any language with a type system that enforces that possibly user-provided strings/data are tagged as such and forced to be sanitized before use in pote
by alecbz 5y ago
Is there any language with a type system that enforces that possibly user-provided strings/data are tagged as such and forced to be sanitized before use in potentially dangerous functions?
This seems like the kind of thing that if done well, could eliminate entire classes of bugs without being too burdensome.
- joshuamorton 5y agoA lot of (most?) type systems can enforce this, but don't by default. You'd define a class "SanitizedStr" (or in this particular case "Path") and have all path operations work on that. Python's pathlib sort of does this, although there's still attacks possible with stuff like joining with an absolute path.
- blandflakes 5y agoNot particularly mainstream, but I remember Ballerina having this: https://ballerina.io/1.0/learn/by-example/taint-checking.html https://ballerina.io/1.0/learn/by-example/taint-checking.htm...
- JulianMorrison 5y agoTaint mode in Perl.