29 ms·

As a theoretical aside, I wonder if it'd be possible to have a typesystem based solution to these kinds of problems - where variables coming from the user (or f

As a theoretical aside, I wonder if it'd be possible to have a typesystem based solution to these kinds of problems - where variables coming from the user (or from another program) are considered 'unsafe' and the compiler refuses to let exec() or whatever use them until they've been through a cleaner/tester of some kind... (OK, I know PHP doesn't have a compiler as such - but a static checker of some kind could work the same...)

gst 12y ago
https://en.wikipedia.org/wiki/Taint_checking https://en.wikipedia.org/wiki/Taint_checking
- _pmf_ 12y ago
  Of note is that Perl had this since at least 1998. See http://gunther.web66.com/FAQS/taintmode.html http://gunther.web66.com/FAQS/taintmode.html But of course we just laugh about Perl and pat ourself on our backs with our safe new languages because we clearly know much more than those anachronistic neckbeards.
  - Silhouette 12y ago
    But of course we just laugh about Perl and pat ourself on our backs with our safe new languages And there is some justification for that: if those "safe new languages" are doing the type checking at compile time, that is better than only finding out you have a safety issue when you fail at run time.
  - brohee 12y ago
    The issue I have with Perl taint checking is that data is untainted by a group match within a regexp. It's not explicit enough and it's easy enough to find legitimate code with accidental untainting of dangerous data. Ruby requires an explicit untaint call, and IMHO it's the right way to go.
- deckiedan 12y ago
  Ah, "Taint" was the missing magic word I couldn't figure out to aid my google-fu (well, duckduckgofu...). Thanks for that - there is a lot of interesting stuff out there. :-)
adamnemecek 12y ago
http://www.impredicative.com/ur/ http://www.impredicative.com/ur/
riffraff 12y ago
perl and ruby have "taint" which is similar to what you describe. And yes, this can be encoded in the type system and you can also make it so the sanitization is context dependent, i.e. http://www.comp.nus.edu.sg/~prateeks/papers/csas-ccs11.pdf http://www.comp.nus.edu.sg/~prateeks/papers/csas-ccs11.pdf
- jonnyscholes 12y ago
  PHP does to http://pecl.php.net/package/taint http://pecl.php.net/package/taint but I haven’t used it or the perl/ruby ones so I'm not actually sure how similar they are...
  - hellerbarde 12y ago
    How ironic.
Argorak 12y ago
On the practical side, Ruby (MRI specifically) has such a system ($SAFE), that taints certain objects (e.g. those gained by IO) and only allows you to use them in certain fashions (e.g. only after explicit handling). It's leaky as hell, because all components have to get the marking right. Also, not all Objects have equal trust levels. Objects created due to a HTTP request (GET-Parameters) should certainly be tainted, but how about Object read through IO - do we trust out filesystem? Do we trust the database? Thats more of an architectural decision. In the end, the problem comes down to this: you have to whitelist the world and everything you miss is an error.
Morgawr 12y ago
There is Argos[0] which is a research project at my university, it's a qemu-based emulator that tracks tainted data coming from the network and other compromised sources and makes sure it doesn't tamper with memory or filesystem locations than it shouldn't. It's a bit overkill,especially for this, but it's interesting to check out :) [0] http://www.few.vu.nl/argos/?page=1 http://www.few.vu.nl/argos/?page=1
MichaelGG 12y ago
Phantom types can help with this. F#'s unit of measurement does something similar for numbers.
zoomerang 12y ago
It's pretty easy to implement such a feature in any strongly typed language, but sadly few framework/libraries/stacks actually do it.
sltkr 12y ago
Then people notice that exec($_GET['foo']) doesn't work, but some smart cookie figures out that exec(untaint($_GET['foo'])) (or whatever the syntax is for removing the taint from an input variable) does, posts it online, and everyone copies that instead without thinking about the consequences.
slight 12y ago
PHP has a runtime taint checker module: http://www.php.net/manual/en/book.taint.php http://www.php.net/manual/en/book.taint.php
chriswarbo 12y ago
Here's one approach: http://blog.moertel.com/posts/2006-10-18-a-type-based-solution-to-the-strings-problem.html http://blog.moertel.com/posts/2006-10-18-a-type-based-soluti... Different languages (SQL, JS, HTML, Shell, Plaintext, etc.) are treated as different types. Language-specific functions only accept arguments of the relevant type (eg. shell_exec takes Shell, db_query takes SQL, etc.). User input is Plaintext (usually; sometimes it might be something more specific like BASE64). Different languages can't be combined (eg. SQL can't be concatenated with Plaintext), but they can be converted down to Plaintext and Plaintext can be converted to any language via escaping functions. This avoids injection attacks, since the only way to please the type-checker is by escaping properly.
shakesbeard 12y ago
https://wiki.php.net/rfc/taint https://wiki.php.net/rfc/taint

gst 12y ago

https://en.wikipedia.org/wiki/Taint_checking https://en.wikipedia.org/wiki/Taint_checking

_pmf_ 12y ago
Of note is that Perl had this since at least 1998. See http://gunther.web66.com/FAQS/taintmode.html http://gunther.web66.com/FAQS/taintmode.html But of course we just laugh about Perl and pat ourself on our backs with our safe new languages because we clearly know much more than those anachronistic neckbeards.
- Silhouette 12y ago
  But of course we just laugh about Perl and pat ourself on our backs with our safe new languages And there is some justification for that: if those "safe new languages" are doing the type checking at compile time, that is better than only finding out you have a safety issue when you fail at run time.
- brohee 12y ago
  The issue I have with Perl taint checking is that data is untainted by a group match within a regexp. It's not explicit enough and it's easy enough to find legitimate code with accidental untainting of dangerous data. Ruby requires an explicit untaint call, and IMHO it's the right way to go.
deckiedan 12y ago
Ah, "Taint" was the missing magic word I couldn't figure out to aid my google-fu (well, duckduckgofu...). Thanks for that - there is a lot of interesting stuff out there. :-)

adamnemecek 12y ago

http://www.impredicative.com/ur/ http://www.impredicative.com/ur/

riffraff 12y ago

perl and ruby have "taint" which is similar to what you describe. And yes, this can be encoded in the type system and you can also make it so the sanitization is context dependent, i.e. http://www.comp.nus.edu.sg/~prateeks/papers/csas-ccs11.pdf http://www.comp.nus.edu.sg/~prateeks/papers/csas-ccs11.pdf

jonnyscholes 12y ago
PHP does to http://pecl.php.net/package/taint http://pecl.php.net/package/taint but I haven’t used it or the perl/ruby ones so I'm not actually sure how similar they are...
- hellerbarde 12y ago
  How ironic.

Argorak 12y ago

On the practical side, Ruby (MRI specifically) has such a system ($SAFE), that taints certain objects (e.g. those gained by IO) and only allows you to use them in certain fashions (e.g. only after explicit handling). It's leaky as hell, because all components have to get the marking right. Also, not all Objects have equal trust levels. Objects created due to a HTTP request (GET-Parameters) should certainly be tainted, but how about Object read through IO - do we trust out filesystem? Do we trust the database? Thats more of an architectural decision. In the end, the problem comes down to this: you have to whitelist the world and everything you miss is an error.

Morgawr 12y ago

There is Argos[0] which is a research project at my university, it's a qemu-based emulator that tracks tainted data coming from the network and other compromised sources and makes sure it doesn't tamper with memory or filesystem locations than it shouldn't. It's a bit overkill,especially for this, but it's interesting to check out :) [0] http://www.few.vu.nl/argos/?page=1 http://www.few.vu.nl/argos/?page=1

MichaelGG 12y ago

Phantom types can help with this. F#'s unit of measurement does something similar for numbers.

zoomerang 12y ago

It's pretty easy to implement such a feature in any strongly typed language, but sadly few framework/libraries/stacks actually do it.

sltkr 12y ago

Then people notice that exec($_GET['foo']) doesn't work, but some smart cookie figures out that exec(untaint($_GET['foo'])) (or whatever the syntax is for removing the taint from an input variable) does, posts it online, and everyone copies that instead without thinking about the consequences.

slight 12y ago

PHP has a runtime taint checker module: http://www.php.net/manual/en/book.taint.php http://www.php.net/manual/en/book.taint.php

chriswarbo 12y ago

Here's one approach: http://blog.moertel.com/posts/2006-10-18-a-type-based-solution-to-the-strings-problem.html http://blog.moertel.com/posts/2006-10-18-a-type-based-soluti... Different languages (SQL, JS, HTML, Shell, Plaintext, etc.) are treated as different types. Language-specific functions only accept arguments of the relevant type (eg. shell_exec takes Shell, db_query takes SQL, etc.). User input is Plaintext (usually; sometimes it might be something more specific like BASE64). Different languages can't be combined (eg. SQL can't be concatenated with Plaintext), but they can be converted down to Plaintext and Plaintext can be converted to any language via escaping functions. This avoids injection attacks, since the only way to please the type-checker is by escaping properly.

shakesbeard 12y ago

https://wiki.php.net/rfc/taint https://wiki.php.net/rfc/taint