Hacker News Reader

Comment by tyingq | Hacker News Reader

"If you can be sure that the input comes from a trustworthy source"

Perl's "taint"[1] capability is pretty interesting in this space. Do other languages have something similar?

[1] https://perldoc.perl.org/perlsec.html#Taint-mode

"You may not use data derived from outside your program to affect something else outside your program--at least, not by accident. All command line arguments, environment variables, locale information (see perllocale), results of certain system calls (readdir(), readlink(), the variable of shmread(), the messages returned by msgrcv(), the password, gcos and shell fields returned by the getpwxxx() calls), and all file input are marked as "tainted"."

Unrelated rant: Sometime recently mobile chrome omits any part of a url after a # when you copy/share the url. Grrr.

View on HN

I'm not aware of a similar feature built into other languages, but most of it could be easily achieved with almost any type system.

Just have two separate types, e.g. UnsafeString and regular String, and some kind of `convert` function that takes a validation function as an argument. You'd get compile-time checking that way.

People don't tend to use such things in practice though, and you would also have to ban a portion of most language's standard libraries to enforce it in practice (because they already return regular strings for inputs).

This can be a useful pattern - though I’ve never seen it used for this usecase. A similar one is templating languages (like Jinja) where you need to wrap strings if you want to send HTML to your templates with them being escaped on render.

We use something similar where we have a BadNumber class in our code (python). Any operation with another number will also create a BadNumber. It allows us to make sure that these tainted numbers are always obvious.

You could use an import hook in python, then create a whitelist of APIs that will be mapped to UnsafeString and then will receive SafeString as an argument.

How about implementing it as an access modifier like "trusted" and enforce that only values from other trusted members can be assigned to a trusted member?

I think this is just refinement types. You wouldn't so much ban the stdlib as need to wrap it.

Wow that's interesting. I've never heard of this in Perl or Ruby, and I always thought of taint analysis as static rather than dynamic.

Though I don't have experience with it, maybe one reason it isn't used is because of false positives?

For efficiency reasons, Perl takes a conservative view of whether data is tainted. If an expression contains tainted data, any subexpression may be considered tainted, even if the value of the subexpression is not itself affected by the tainted data.

Has anyone used this? Is the runtime overhead always there, or only when you turn the taint mode on? It seems like it would have to occupy some extra space in the string objects all the time? (Although I guess if it's literally a single bit, it can come for "free" because of padding)

-----

FWIW here are some references on static taint analysis:

https://cacm.acm.org/magazines/2019/8/238344-scaling-static-...

cites https://www.usenix.org/legacy/event/sec06/tech/full_papers/x...

"Has anyone used this?"

Perhaps not much on purpose, but it kicks in automatically if the Perl script is setuid. So you'll find questions about it where people are struggling with it.

Dynamic taint analysis is a really common technique in academic work, but largely has unacceptable performance costs for interesting applications. Typical costs range from 10% to 100% overhead or more. The other problem is that the entire system needs to track it. If you just own part of a system, instrumenting to add dynamic taint tracking can be really difficult.

IIRC all CGI scripts were run with the taint checker on some systems.

>Unrelated rant: Sometime recently mobile chrome omits any part of a url after a # when you copy/share the url. Grrr.

It's probably sharing the canonical link. That's the "correct" behaviour as defined by browsers. Definitely not ideal in your example, though.

It’s in Ruby as well, inherited from Perl. It doesn’t get much use though.

It's used in Rails to reduce the likelihood of un-sanitized user input in SQL fragments [1]. I think it would see a lot more use if additional input sources were marked as tainted [2].

[1] https://api.rubyonrails.org/classes/ActiveRecord/Base.html#c...

[2] http://www.jkfill.com/2012/03/10/preventing-mass-assignment-...

Nim has something similar in the works, barely implemented.

https://nim-lang.org/docs/manual_experimental.html#taint-mod...

This can be done with a special type representing "trusted" data. For example, Go has template.HTML representing data that's safe to render without escaping. Everything else gets escaped.

Reply on news.ycombinator.com