| Weekly edition | Kernel | Security | Distributions | Search |
| Archives | Calendar | Subscribe | Write for LWN | LWN.net FAQ |
Language versus application security
Language versus application security
Posted Jan 30, 2003 18:21 UTC (Thu) by JoeBuck (subscriber, #2330)In reply to: Language versus application security by copsewood
Parent article: A look at the MS-SQL worm
Perl doesn't have buffer overflows, but Perl-based web applications have had tons of security holes, mostly caused by not sufficiently checking user-supplied data (../../.. in paths, cross-site scripting, and the like).
(Log in to post comments)
Language versus application security
Posted Jan 31, 2003 0:54 UTC (Fri) by copsewood (subscriber, #199) [Link]
Yep. The approach of deciding what valid data should look like and excluding everything else is similar to the default-deny approach to firewall setups. This can reduce functionality slightly or slightly increases the effort of getting added functionality secure, but its probably much less hassle than trying specifically to exclude what is considered dangerous when you can only ever have limited knowledge of what might be exploitable in future.