Re: CGI scripting (in 8th)

From	anton@mips.complang.tuwien.ac.at (Anton Ertl)
Newsgroups	comp.lang.forth
Subject	Re: CGI scripting (in 8th)
Date	2015-10-14 09:33 +0000
Organization	Institut fuer Computersprachen, Technische Universitaet Wien
Message-ID	<2015Oct14.113333@mips.complang.tuwien.ac.at> (permalink)
References	(1 earlier) <23b5d12d-b247-4d73-9f5e-a7349190d984@googlegroups.com> <mvji1k$k36$1@dont-email.me> <0ab7a893-c262-4846-91d4-05192916f5b5@googlegroups.com> <mvknm3$l8d$1@dont-email.me> <87wpuq0y7n.fsf@jester.gateway.sonic.net>

Show all headers | View raw

Paul Rubin <no.email@nospam.invalid> writes:
>The concern with C is that it's possible for malicious client programs
>to inject arbitrary code into a running C cgi that's buggy, such as by
>overwriting return addresses on the stack to point into data buffers
>that the client sent.  "Safe" languages like Python and (cough) Java
>prevent these attacks by a mixture of more compile time type safety and
>more runtime checks against out-of-range subscripts and the like.

Nice theory.  In practice, such languages and their run-time systems
(and the libraries written in C) also have their bugs, and last year I
listened to a master's thesis where the topic was how to increase the
safety against attacks in such a "safe" language (IIRC it was
JavaScript).  The premise of the work (which the student did not even
mention) was that the attacker can write to pretty much any writable
memory; so apparently that work had given up on the idea that the
"safe" language prevents such vulnerabilities; the current perception
of Java as insecure does not support your theory, either.

- anton
-- 
M. Anton Ertl  http://www.complang.tuwien.ac.at/anton/home.html
comp.lang.forth FAQs: http://www.complang.tuwien.ac.at/forth/faq/toc.html
     New standard: http://www.forth200x.org/forth200x.html
   EuroForth 2015: http://www.rigwit.co.uk/EuroForth2015/

Thread

CGI scripting (in 8th) Ron Aaron <rambamist@gmail.com> - 2015-10-13 16:56 +0300
  Re: CGI scripting (in 8th) foxaudioresearch@gmail.com - 2015-10-13 10:51 -0700
    Re: CGI scripting (in 8th) "Elizabeth D. Rather" <erather@forth.com> - 2015-10-13 08:05 -1000
      Re: CGI scripting (in 8th) foxaudioresearch@gmail.com - 2015-10-13 11:54 -0700
    Re: CGI scripting (in 8th) Ron Aaron <rambamist@gmail.com> - 2015-10-13 21:22 +0300
      Re: CGI scripting (in 8th) foxaudioresearch@gmail.com - 2015-10-13 11:53 -0700
        Re: CGI scripting (in 8th) "Elizabeth D. Rather" <erather@forth.com> - 2015-10-13 11:57 -1000
        Re: CGI scripting (in 8th) Ron Aaron <rambamist@gmail.com> - 2015-10-14 08:04 +0300
          Re: CGI scripting (in 8th) Paul Rubin <no.email@nospam.invalid> - 2015-10-13 23:18 -0700
            Re: CGI scripting (in 8th) Ron Aaron <rambamist@gmail.com> - 2015-10-14 09:25 +0300
            Re: CGI scripting (in 8th) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2015-10-14 09:33 +0000
    Re: CGI scripting (in 8th) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2015-10-14 09:50 +0000
      Re: CGI scripting (in 8th) foxaudioresearch@gmail.com - 2015-10-15 11:31 -0700

csiph-web