Secure Coding mailing list archives
Re: SPI, Ounce Labs Target Poorly Written Code
From: James Walden <jwalden () eecs utoledo edu>
Date: Wed, 30 Jun 2004 14:49:20 +0100
Blue Boar wrote: To clarify, I'm talking about things like passing unfiltered user input to a system shell, or a native API, something like that. True. In the case of passing a user input string to the shell or a database server, you're accepting what's potential a program as input. However, if your language's type system considers that program to be a string, there's no way your compiler can perform relevant security checks. I've read papers on the topic of adding new data types like relational database tables or XML documents to existing languages (as Xen does for C#), expanding the type system to deal with such data directly instead of reducing it to a string that the compiler can't automatically type check. However, there are always going to be new programs to pass data to, and strings will always be a convenient choice of packaging new unknown data types, so I don't see this problem going away in the future, though particular attack instances like SQL injection may disappear. -- James Walden, Ph.D. Visiting Assistant Professor of EECS The University of Toledo @ LCCC http://www.eecs.utoledo.edu/~jwalden/ [EMAIL PROTECTED]
Current thread:
- SPI, Ounce Labs Target Poorly Written Code Kenneth R. van Wyk (Jun 28)
- Re: SPI, Ounce Labs Target Poorly Written Code Blue Boar (Jun 29)
- Re: SPI, Ounce Labs Target Poorly Written Code Crispin Cowan (Jun 30)
- <Possible follow-ups>
- RE: SPI, Ounce Labs Target Poorly Written Code Peter Amey (Jun 29)
- RE: SPI, Ounce Labs Target Poorly Written Code ljknews (Jun 29)
- Re: SPI, Ounce Labs Target Poorly Written Code Blue Boar (Jun 29)
- Re: SPI, Ounce Labs Target Poorly Written Code James Walden (Jun 30)
- Re: SPI, Ounce Labs Target Poorly Written Code Blue Boar (Jun 29)