3 ms·
With all the hacks and exploits going on, and (Log4J) more security awareness coming, I've been considering a safe String class that prevents some characters l
by KingOfCoders 5y ago
With all the hacks and exploits going on, and (Log4J) more security awareness coming,
I've been considering a safe String class that prevents some characters like CR,LF,\ that are seldom needed in business strings but used in system level things. Drawing a line between these two would increase security.
- bdamm 5y agosafe would be more a property of where it came from, and maybe what processing the string has had on it. Plenty of business strings have newlines. I like the idea but really I want the type to capture unsafe/semi-safe/safe. Now the trick is, how expressive can the idea of semi-safe be?
- KingOfCoders 5y agoJoel tried to fix the problem / source with naming (I remember reading that article, and it's 17 years old!) https://www.joelonsoftware.com/2005/05/11/making-wrong-code-look-wrong/ https://www.joelonsoftware.com/2005/05/11/making-wrong-code-...
- ajnin 5y agoI think it's a good approach but I would do it the opposite way : create an UnsafeString and use that whenever your program takes external inputs. Then make it so that this UnsafeString can't be used directly but must always be consciously converted to (safe) String when using that data anywhere.