Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.forth > #42639
| From | anton@mips.complang.tuwien.ac.at (Anton Ertl) |
|---|---|
| Newsgroups | comp.lang.forth |
| Subject | Re: CGI scripting (in 8th) |
| Date | 2015-10-14 09:50 +0000 |
| Organization | Institut fuer Computersprachen, Technische Universitaet Wien |
| Message-ID | <2015Oct14.115019@mips.complang.tuwien.ac.at> (permalink) |
| References | <mvj2f0$fug$1@dont-email.me> <23b5d12d-b247-4d73-9f5e-a7349190d984@googlegroups.com> |
foxaudioresearch@gmail.com writes:
>On Tuesday, October 13, 2015 at 9:56:47 AM UTC-4, Ron Aaron wrote:
>> It's not just for mobile and desktop:
>>
>> http://8th-dev.com/forum/index.php/topic,595.msg3177.html
>
>One of the common complaints I have heard when it was suggested to Forth for CGI was that it was a security risk. Does 8th include ways to preempt that concern out of the box? Perhaps you can "seal" it to a specific wordlist or some such thing.
You can also seal in Forth, but that's normally not an issue in CGI
programs, because there you don't normally text-interpret the data
coming from the user (of course, if you do text-interpret it, e.g.,
with EVALUATE, you want to seal the search order).
In a bug-free CGI program, whether written in Forth, C, Perl, Python,
or whatever, and assuming that the language implementation is
bug-free, too, there are no vulnerabilities that allow an attacker to
make the process do things that the program was not designed to do.
Unfortunately, programs often have bugs. That has led to the theory
that, if you use a language that allows only restricted ways of
writing to memory ("safe languages"), you cannot have bugs that allow
arbitrary code execution. Unfortunately, there are still bugs like
SQL injection attacks possible in such languages, as well as bugs in
the language implementation that allow arbitrary code execution
attacks even on programs written in "safe languages".
It all comes down to whether you think that your Forth (or 8th)
program combined with your Forth (or 8th) implementation will be more
secure than the alternative.
- anton
--
M. Anton Ertl http://www.complang.tuwien.ac.at/anton/home.html
comp.lang.forth FAQs: http://www.complang.tuwien.ac.at/forth/faq/toc.html
New standard: http://www.forth200x.org/forth200x.html
EuroForth 2015: http://www.rigwit.co.uk/EuroForth2015/
Back to comp.lang.forth | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
CGI scripting (in 8th) Ron Aaron <rambamist@gmail.com> - 2015-10-13 16:56 +0300
Re: CGI scripting (in 8th) foxaudioresearch@gmail.com - 2015-10-13 10:51 -0700
Re: CGI scripting (in 8th) "Elizabeth D. Rather" <erather@forth.com> - 2015-10-13 08:05 -1000
Re: CGI scripting (in 8th) foxaudioresearch@gmail.com - 2015-10-13 11:54 -0700
Re: CGI scripting (in 8th) Ron Aaron <rambamist@gmail.com> - 2015-10-13 21:22 +0300
Re: CGI scripting (in 8th) foxaudioresearch@gmail.com - 2015-10-13 11:53 -0700
Re: CGI scripting (in 8th) "Elizabeth D. Rather" <erather@forth.com> - 2015-10-13 11:57 -1000
Re: CGI scripting (in 8th) Ron Aaron <rambamist@gmail.com> - 2015-10-14 08:04 +0300
Re: CGI scripting (in 8th) Paul Rubin <no.email@nospam.invalid> - 2015-10-13 23:18 -0700
Re: CGI scripting (in 8th) Ron Aaron <rambamist@gmail.com> - 2015-10-14 09:25 +0300
Re: CGI scripting (in 8th) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2015-10-14 09:33 +0000
Re: CGI scripting (in 8th) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2015-10-14 09:50 +0000
Re: CGI scripting (in 8th) foxaudioresearch@gmail.com - 2015-10-15 11:31 -0700
csiph-web