3 ms·
Is there anything similar for Common Lisp? For now, I’m using JSON because I’m paranoid about code injection attacks around print/read. I’ve seen a handful of
by schemescape 3y ago
Is there anything similar for Common Lisp?
For now, I’m using JSON because I’m paranoid about code injection attacks around print/read.
I’ve seen a handful of libraries, but each one claims to protect against a different kind of attack, so that makes me think they might be vulnerable to the ones they don’t mention.
Edit: I’m not sure if I understood this submission properly, but I’ll leave my question up since I’m still interested.
Edit again: looks like someone asked this exact question on SO: https://stackoverflow.com/questions/34813891/how-do-you-securely-parse-untrusted-input-in-common-lisp https://stackoverflow.com/questions/34813891/how-do-you-secu...
- baq 3y agoJSON and this should be isomorphic if you squint a bit. You shouldn’t use eval for parsing sexps from the network in the same way you shouldn’t eval json in JavaScript (obvious yes I know but the solution is the same - use a parser instead)
- schemescape 3y agoRight, that’s why I was asking if there was some sort of lossless encoding for simple Lisp types (“simple” I’m leaving undefined for now). For now, I encode everything as JSON, then decode back into lists, etc. on the other side (using cl-json). I was hoping there might be something more direct. But who knows, maybe the JSON libraries are so optimized they’re faster anyway!
- ducktective 3y agoWhy would you want to transmit s-exps over a network? What's wrong with HTTPS or TCP/TLS?
- schemescape 3y agoI meant over HTTPS.
- EddieJLSH 3y agoWhat's the realistic issue with code injection over HTTPS TCP parsing into expected messages? If it is an issue for your system, can't you try read into some expected shape and throw an error if it doesn't parse to circumvent that?
- schemescape 3y agoI was specifically talking about Common Lisp’s print/read functions which are not safe for untrusted input: https://github.com/salewski/cl-safe-read/blob/master/README.md https://github.com/salewski/cl-safe-read/blob/master/README....
- stefncb 3y agoThe solution is to not use the reader and instead write a parser yourself. S-Expressions are really simple, you should be able to do that quite easily.
- schemescape 3y agoI was hoping it was easy enough that someone had already done it :) Escaping strings and parsing floating point numbers isn’t something I enjoy.
- fiddlerwoaroof 3y agoI think this should be safe: https://github.com/phoe/safe-read https://github.com/phoe/safe-read This doesn’t provide such functionality out of the box, but it makes it pretty trivial to produce a custom READ that only has the features you want: https://github.com/s-expressionists/Eclector https://github.com/s-expressionists/Eclector It’s not exactly the right input format, and has a couple outstanding performance issues, but I wrote a parser for EDN which should be safe against code injection: https://github.com/fiddlerwoaroof/cl-edn https://github.com/fiddlerwoaroof/cl-edn
- schemescape 3y agoThanks! safe-read and this other one are what I’d seen before: https://github.com/mabragor/cl-secure-read https://github.com/mabragor/cl-secure-read I’ll look at them more closely.