Re: Thoughts on Shellshock and beyond

[Tim <tim-security () sentinelchicken org>]

> > Well, I think we can all think of a few options, some more portable
> > than others.  The current namespace change is one option, obviously,
>
> But that's not really separating code and data, right? It doesn't feel
> like it follows the spirit of this phrasing:
>
> "When an existing construct in a system is widely expected to be used
> for storing data, avoid overloading it for use of storing code."
>
> ...because it very much overloads the syntax to store code alongside
> with the data, in a way that theoretically shouldn't but in practice
> may collide. It's not a whole lot better than the "separation" of CSS
> and JS in HTML, in the sense that both of them are sort of guarded by
> delineated by specific syntax structures.

I think you're taking on a too rigid mindset here.  Taking the
phrasing too literally.


All code *is* data.  Machine code is bytes in memory, which is data.
Therefore code is a subset of data.  No matter where you put it, it's
mixed in that highly abstract sense.  In hardware architectures we
designate certain pieces of memory to store code and others to store
things that aren't instructions.  This is fine.  It is mostly well
defined and people have reasonable expectations about this
designation.  Same thing with environment variables that have
designated purposes/namespaces/whatever.  The problem comes about when
you have no designation and no expectation of which is which.


tim