3 ms·
> Bottom line is that you need to validate your input from outside the process if you're running in a privileged context[1] What this "if" qualifier? You need
by lelanthran 2y ago
> Bottom line is that you need to validate your input from outside the process if you're running in a privileged context[1]
What this "if" qualifier? You need to validate all input from outside the process. Whether the process is privileged or not is, frankly, not really relevant.
(I submitted a blog post a few days ago explaining "Parse, Don't Validate" in plain C, but it didn't get any traction).
- ajross 2y ago> What this "if" qualifier? You need to validate all input from outside the process. Not all tools are designed to accept input from outside a security boundary. Obviously atop isn't one, but the world is filled with software that misbehaves on bad input. Ever DDoS your build system by misconfiguring something? Crash a running program by removing a cache directory (or unpacking a tarball on top of it)? It's very rarely a bad idea to fail to validate input. But it's for sure not always a requirement either. And to be blunt, it's not really possible either. You write "insecure" parsers/interpreters/whatever probably every day, we all do. And you "know" when it's safe and when it's not, I'm sure. But my point is that if that knowledge isn't based on at least a little bit of rigor ("crossing a privilege boundary" in this case), you're probably going to do it wrong.