Re: String tainting
[
Date Prev][
Date Next][
Thread Prev][
Thread Next]
[
Date Index]
[
Thread Index]
- Subject: Re: String tainting
- From: Luis Carvalho <carvalho@...>
- Date: Fri, 8 Feb 2008 11:21:11 -0500
> I realized that when I was writing my __concat function.
> It also means string tainting will need to be built into the core and
> can not be bolted on using the public API. Since I'm not familiar with
> the inner workings of the core I wanted to know if anybody had done
> something similar before.
You could get away with something like:
-- taint.lua
local newproxy, getmetatable, tostring = newproxy, getmetatable, tostring
module(...)
local strings = {} -- tainted strings
local tainted = newproxy(true) -- tainted object
local mt = getmetatable(tainted)
mt.__index = function(o, k)
local s = strings[o]
if k == "string" then
return s
else
return s.k
end
end
mt.__concat = function(o1, o2)
local s1 = getmetatable(o1) == mt and strings[o1] or o1
local s2 = getmetatable(o2) == mt and strings[o2] or o2
return s1 .. s2
end
mt.__tostring = function(o) return strings[o] end
mt.__len = function(o) return #strings[o] end
function string (s) -- taint s
local u = newproxy(tainted)
strings[u] = tostring(s)
return u
end
function check (s) -- tainted?
return getmetatable(s) == mt
end
Cheers,
Luis.
--
A mathematician is a device for turning coffee into theorems.
-- P. Erdos
--
Luis Carvalho
Applied Math PhD Student
Brown University