Re: io:lines() and \0

[Tim Hill <drtimhill@...>]

On Feb 22, 2014, at 4:16 PM, Petite Abeille <petite.abeille@gmail.com> wrote:

> 
> On Feb 23, 2014, at 12:48 AM, Tim Hill <drtimhill@gmail.com> wrote:
> 
>> No,
> 
> Shocker.
> 
>> but it’s clear that io:lines() is a dangerous API to use unless you have complete control over the input dataset.
> 
> ( Meh. Sounds like a drama-queen argument, with a dose of tunnel vision. Anyway, to each their own. )
> 
> 

No not at all. Think for a minute. When you feed io:lines() malformed input it generates odd results, with no errors. This is pay-dirt for hackers trying to break into computer systems. A hacker sits down, finds some naive Lua code on a web server that uses io:lines() and then feeds it various inputs with ‘\0’ characters until he gets something “interesting” to happen. And this isn’t paranoia, there have been far less obvious vulnerabilities used in the past for some pretty dramatic exploits.

—Tim