3 ms·
By that standard almost any bug could be considered a "security bug", including things like "returns error even though my XML is valid" or "it parses this data
by arp242 1y ago
By that standard almost any bug could be considered a "security bug", including things like "returns error even though my XML is valid" or "it parses this data wrong".
- me_jumper 1y agoWell, yes... Differentials in parsing of the same data can definitely lead to security vulnerabilities. Just some random examples: - https://www.ias.cs.tu-bs.de/publications/parsing_differentials.pdf https://www.ias.cs.tu-bs.de/publications/parsing_differentia... - https://www.ndss-symposium.org/ndss-paper/diffcsp-finding-browser-bugs-in-content-security-policy-enforcement-through-differential-testing/ https://www.ndss-symposium.org/ndss-paper/diffcsp-finding-br... - https://www.brainonfire.net/blog/2022/04/11/what-is-parser-mismatch/ https://www.brainonfire.net/blog/2022/04/11/what-is-parser-m...