3 ms·
Perl has had a limited data tagging system for decades now, called "taint checking". If enabled (through a command line switch), all data coming in from the ou
by perlgeek 2y ago
Perl has had a limited data tagging system for decades now, called "taint checking".
If enabled (through a command line switch), all data coming in from the outside (sockets, STDIN etc.) are "tainted", and if you e.g. concatenate a non-tainted and a tainted string, it becomes tainted. Certain sensitive operations, like system() calls or open(), raise an error when used with tainted data.
If you match tainted data with a regex, the match groups are automatically untainted.
It's not perfect, but it demonstrates that such data tagging is possible, and quite feasible if integrated early enough in the language.
- hinkley 2y agoRails has a “safe” attribute that only works for html output, and doesn’t work right for urls (a bug that somehow became my responsibility to fix many times). It’s a limited version of the same thing and I believe Elixir has the same design, and I’ve already seen a reproduction of the Rails flaw in Elixir. But they are Boolean values and they need to be an enumeration or likely a bitfield. Even just for web I’ve already identified four in this thread. HTML unsafe, url unsafe, PII unsafe, credentials unsafe. I hesitate to add SQL unsafe because the only solution to sql injection is NO STRING CONCATENATION. But so many SQL libraries use concatenation even for prepared statements that maybe it should be. Only allow string constants for sql queries.