I don't think homoiconicity is the issue, except in a very indirect way. Note that Common Lisp does have a rather annoying, insecure default that did allow the kind of attack you're talking about: *read-eval* defaults to T <http://clhs.lisp.se/Body/v_rd_eva.htm>, which enables the #. reader macro, which can be used to execute code when reading input. This could have been bad news at a nuclear weapons labs<https://gist.github.com/wiseman/4709438> .
But note that code written in Ruby<http://blog.codeclimate.com/blog/2013/01/10/rails-remote-code-execution-vulnerability-explained/>, PHP <http://stackoverflow.com/questions/3115559/exploitable-php-functions>, Perl<http://www.iss.net/security_center/reference/vuln/DataProtector_EXEC_CMD_Exec.htm>and just about every language has had basically the exact same sort of vulnerability at some point. It's not homoiconicity that makes it possible (or likely), it's having an interpreter or compiler available. On Tue, Jan 21, 2014 at 9:10 PM, Luc Prefontaine < lprefonta...@softaddicts.ca> wrote: > Your last statement is incomplete. > > It all depends on trust. We do eval at > runtime of code and data w/o edn > but we know it comes from a secured > source. > > Doing such thing from an unsecured > alien source would "potentially" look insane. Lets not presume about > the insanity of the designer w/o some deeper analysis :))) > > Luc P. > > > Hi Daniel, > > > > I'm not an expert in security but AFAIK this is not a problem. Every user > > input is a string and you chose how to parse it. There is a edn reader > that > > is safe, but you can use specific parsers depending on the input. Of > course > > if you read and eval the string anything could happen, but nobody would > do > > that. > > > > Best, > > mynomoto > > > > On Tuesday, January 21, 2014 10:22:11 PM UTC-2, Daniel Compton wrote: > > > > > > I've been thinking for a while about what the security implications are > > > for a homoiconic language like Clojure where code is data and data is > code. > > > What protections do you have against malicious input being > automatically > > > evaluated by the reader? It seems like every user input would be a > possible > > > case of 'Clojure injection'. Is this an issue or am I missing something > > > really obvious here? > > > > > > Thanks, Daniel. > > > > > > > -- > > -- > > You received this message because you are subscribed to the Google > > Groups "Clojure" group. > > To post to this group, send email to clojure@googlegroups.com > > Note that posts from new members are moderated - please be patient with > your first post. > > To unsubscribe from this group, send email to > > clojure+unsubscr...@googlegroups.com > > For more options, visit this group at > > http://groups.google.com/group/clojure?hl=en > > --- > > You received this message because you are subscribed to the Google > Groups "Clojure" group. > > To unsubscribe from this group and stop receiving emails from it, send > an email to clojure+unsubscr...@googlegroups.com. > > For more options, visit https://groups.google.com/groups/opt_out. > > > -- > Luc Prefontaine<lprefonta...@softaddicts.ca> sent by ibisMail! > > -- > -- > You received this message because you are subscribed to the Google > Groups "Clojure" group. > To post to this group, send email to clojure@googlegroups.com > Note that posts from new members are moderated - please be patient with > your first post. > To unsubscribe from this group, send email to > clojure+unsubscr...@googlegroups.com > For more options, visit this group at > http://groups.google.com/group/clojure?hl=en > --- > You received this message because you are subscribed to the Google Groups > "Clojure" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to clojure+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/groups/opt_out. > -- -- You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be patient with your first post. To unsubscribe from this group, send email to clojure+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/clojure?hl=en --- You received this message because you are subscribed to the Google Groups "Clojure" group. To unsubscribe from this group and stop receiving emails from it, send an email to clojure+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
