full-disclosure - Re: When standards attack...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87skyk1gu1.fsf@mid.deneb.enyo.de>
Date: Fri, 21 Mar 2008 12:01:26 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: H D Moore <fdlist@...italoffense.net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: When standards attack...

* H. D. Moore:

> The WebKit folks just added client-side SQL database support:
>  
> http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage/
> http://glazkov.com/blog/html5-gears-wrapper/
>
> In addition to all of the existing attacks through a web browser, we can 
> now take into account SQLite vulnerabilities and client-side SQL 
> injection issues as well.

Interesting.  SQLite is a great piece of software, but it's not very
close to SQL, viz:

sqlite> SELECT 1 = '1';
0
sqlite> 

I wonder how the WebKit folks will bridge this gap, or if the people
behind HTML5 will standardize on whatever SQLite implements.

I'm also a bit surprised that the Javascript folks are suddenly expected
to write their programs in continuation-passing style, without much
syntactic support from the language.  It's like pre-generics Java
typing, but this time for flow control constructs.  Oh well.

> ...because letting developers choose to bind their query parameters has 
> worked so well before ;-)

What's the alternative?  A combinator library?  A language extension
that only permits static query strings?  String interpolation as
structured objects?  Most approaches require a new Ecmascript revision.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/