3 ms·
> there are languages where you can't write insecure code, where the compiler doesn't allow it and will warn you when you do. Where is this wonderful language
by kijin 13y ago
> there are languages where you can't write insecure code, where the compiler doesn't allow it and will warn you when you do.
Where is this wonderful language that throws compiler warnings when the code contains an SQL injection, XSS, or CSRF vulnerability?
- adamnemecek 13y agohttp://www.impredicative.com/ur/ http://www.impredicative.com/ur/
- Shish2k 13y agoNot a complete solution, but I thought perl's "taint" feature was a brilliant idea, and I wish more languages did similar. In short, data provided by the user is automatically marked as "tainted", and cannot be passed into a shell command, an SQL string, printed into the HTML, etc, without being explicitly converted into a safe form. (I'd particularly like it if it were possible for the user to define their own types, so we could have "raw string", "validated HTML string", "validated SQL string", etc - and also "distance in meters", "distance in feet", etc -- and it wouldn't be possible to operate on different types without explicitly converting them into compatible forms)
- adamnemecek 13y agoRuby has it too.
- plorkyeran 13y agoHaskell with Yesod comes as close as is practical (if you explicitly tell it a string is safe to use in a certain context, it will not magically figure out that you're wrong). If you loosen the requirement to just "secure by default" rather than "insecure code fails to compile", most modern web frameworks have built-in automatic CSRF protection and default to escaping all strings when inserting them into HTML.