Gnash, Lightspark, and Shumway

Gnash, Lightspark, and Shumway

Posted Nov 25, 2012 21:38 UTC (Sun) by khim (subscriber, #9252)
In reply to: Gnash, Lightspark, and Shumway by intgr
Parent article: Gnash, Lightspark, and Shumway

I agree that it's ugly, but... WTF, a similar number of vulnerabilities? I can see how PHP's comparison rules can cause vulnerabilities, but JavaScript is a great deal better.

No, it's not. There are about bazillion vulnerabilities found on web sites every day. I mean, XSS, data leaks, etc. Vulnerabilities which affect the web application itself, not the rest of the system.

Rest of the system is not affected by JS vulnerabilities because web apps are sandboxed. Well, you can sandbox C++ application, too, so what's the big deal?

On the other hand, NEARLY ALL security announcements these days are a result of undefined behavior in C code.

Well, sure. That's because security-sensitive unsandboxed applications are written in C++. How many of them are written in JavaScript?

In many cases, C undefined behavior leads to code execution, whereas that just cannot happen in JavaScript unless the coder explicitly calls eval() -- which is used almost never in real code.

Is this a joke or are you really that dumb? Javascript programs have bazillion places where eval() can be injected.

Do you add some data from user to the page? Thank you, thank you - that's eval right there, just add <script></script>.

Do you change innerHTML? Thank you, thank you - that's another place for eval, just add "<script></script>". And so on.

Javascript programs are actually more vulnerable then their C++ counterparts, but most problems are contained because of browser's sandbox. Well, you can add sandbox to C++, so what's the big deal?

---

(Log in to post comments)