3 ms·

https://github.com/google/wuffs https://github.com/google/wuffs <-- DSL created explicitly for wrangling fileformats safely

jonatron 2y ago
Thank you, I spent a few minutes failing to google this.
- actionfromafar 2y ago
  I always do that, sometimes I succeed, sometimes I fail! :-D
internetter 2y ago
Written in C? Unless I'm missing something this isn't better than other unsafe options
- codetrotter 2y ago
  From the Wuffs readme: > Wuffs the Language is safe with respect to buffer overflows, integer arithmetic overflows and null pointer dereferences. A key difference between Wuffs and other memory-safe languages is that all such checks are done at compile time, not at run time. If it compiles, it is safe, with respect to those three bug classes. > […] > Wuffs code is hermetic and can only compute (e.g. convert "compressed bytes" to "decompressed bytes"). It cannot make any syscalls (e.g. it has no ambient authority to read your files), implying that it cannot allocate or free memory (and is therefore trivially safe against things like memory leaks, use-after-frees and double-frees).
yjftsjthsd-h 2y ago
And - https://github.com/google/wuffs/blob/main/doc/std/image-decoders.md#implementations https://github.com/google/wuffs/blob/main/doc/std/image-deco... with a webp implementation.
- tedunangst 2y ago
  From after this exploit was found.
  - yjftsjthsd-h 2y ago
    Oh, you're right; I managed to miss that the vuln was from 2023. I do wonder how widely used the wuffs version is now that it exists, though.
    - tedunangst 2y ago
      wuffs has the same story as rlbox in firefox. They made the tool, they proved it could work with one library, and then proceeded to ignore it for all the other libraries. https://hacks.mozilla.org/2020/02/securing-firefox-with-webassembly/ https://hacks.mozilla.org/2020/02/securing-firefox-with-weba...
      - mccr8 2y ago
        rlbox is used for more than one library: "Now, we’re bringing that technology to all supported Firefox platforms (desktop and mobile), and isolating five different modules: Graphite, Hunspell, Ogg, Expat and Woff2" https://blog.mozilla.org/attack-and-defense/2021/12/06/webassembly-and-back-again-fine-grained-sandboxing-in-firefox-95/ https://blog.mozilla.org/attack-and-defense/2021/12/06/webas...
nxobject 2y ago
I wouldn't be surprised if some security team at Apple was cooking up a bespoke DSL as well – NIH seems to happen once in a while.
- pcwalton 2y ago
  They have some kind of safe dialect of C that they use for iBoot. Also they're increasingly using Swift for things.

jonatron 2y ago

Thank you, I spent a few minutes failing to google this.

actionfromafar 2y ago
I always do that, sometimes I succeed, sometimes I fail! :-D

internetter 2y ago

Written in C? Unless I'm missing something this isn't better than other unsafe options

codetrotter 2y ago
From the Wuffs readme: > Wuffs the Language is safe with respect to buffer overflows, integer arithmetic overflows and null pointer dereferences. A key difference between Wuffs and other memory-safe languages is that all such checks are done at compile time, not at run time. If it compiles, it is safe, with respect to those three bug classes. > […] > Wuffs code is hermetic and can only compute (e.g. convert "compressed bytes" to "decompressed bytes"). It cannot make any syscalls (e.g. it has no ambient authority to read your files), implying that it cannot allocate or free memory (and is therefore trivially safe against things like memory leaks, use-after-frees and double-frees).

yjftsjthsd-h 2y ago

And - https://github.com/google/wuffs/blob/main/doc/std/image-decoders.md#implementations https://github.com/google/wuffs/blob/main/doc/std/image-deco... with a webp implementation.

tedunangst 2y ago
From after this exploit was found.
- yjftsjthsd-h 2y ago
  Oh, you're right; I managed to miss that the vuln was from 2023. I do wonder how widely used the wuffs version is now that it exists, though.
  - tedunangst 2y ago
    wuffs has the same story as rlbox in firefox. They made the tool, they proved it could work with one library, and then proceeded to ignore it for all the other libraries. https://hacks.mozilla.org/2020/02/securing-firefox-with-webassembly/ https://hacks.mozilla.org/2020/02/securing-firefox-with-weba...
    - mccr8 2y ago
      rlbox is used for more than one library: "Now, we’re bringing that technology to all supported Firefox platforms (desktop and mobile), and isolating five different modules: Graphite, Hunspell, Ogg, Expat and Woff2" https://blog.mozilla.org/attack-and-defense/2021/12/06/webassembly-and-back-again-fine-grained-sandboxing-in-firefox-95/ https://blog.mozilla.org/attack-and-defense/2021/12/06/webas...

nxobject 2y ago

I wouldn't be surprised if some security team at Apple was cooking up a bespoke DSL as well – NIH seems to happen once in a while.

pcwalton 2y ago
They have some kind of safe dialect of C that they use for iBoot. Also they're increasingly using Swift for things.