3 ms·
That is a valid concern, however it doesn't mean you have to worry about escaping all text properly. You can simply handle the elements as lists, and code won'
by Goladus 19y ago
That is a valid concern, however it doesn't mean you have to worry about escaping all text properly. You can simply handle the elements as lists, and code won't get executed.
As an exercise, I tried parsing a few entries in that java log format from the article, but changed a few things. In particular, I replaced the message string with one written with unescaped text that the user might have been responsible for.
I suck at Lisp, but in 28 lines (6 defuns and 1 defparameter) here's what I got for output. Note that (FORMAT T "injection") gets printed directly is not executed.
Entry:("2005-02-21T18:57:39")('SEVERE)("A pretty bad thing has happened! The user did this: " (FORMAT T "injection") ".")
Entry:("2007-09-11T18:57:39")('SEVERE)("A very very bad thing has happened! The user did this: ...")
Entry:("2907-09-11T18:57:39")('WARNING)("A sorta bad thing has happened! The user did this: ...")
- Goladus 19y agoHere's the code, with "jlog" instead of log. I must have log defined somewhere (like I said, I suck at Lisp). (defparameter *handlethese* '(date level message)) (defun date (obj) (prin1 obj)) (defun level (obj) (prin1 obj)) (defun message (obj) (prin1 obj)) (defun record (record-data) (if (car record-data) (progn (if (member (car (car record-data)) *handlethese*) (funcall (car (car record-data)) (cdr (car record-data))) nil) (record (cdr record-data))) nil)) (defun process-jlog(record-list) (if (car record-list) (progn (format t "~%Entry:") (funcall (car (car record-list)) (cdr (car record-list))) (process-jlog (cdr record-list))) t)) (defun jlog (&rest record-list) (process-jlog record-list))