Hacker News new | ask | show | jobs
by rwmj 5027 days ago
You should probably read the link more closely. I'm advocating using JSON so that programs are able to safely parse the output of 'qemu-img'. At the moment there are many programs that parse the (current text) output, and they almost all have security holes as a result.
1 comments
nnnnnnnn 5027 days ago
In any event it does not support your assertion that other languages suffer similar problems.
link
rwmj 5027 days ago
Yes it does - qemu-img is written in C. The two programs we found exploitable were written in Python and C. They are written in "satisfactory" languages. Bash is not involved. Yet both suffer exploits because of \n (and other) characters in filenames.
link
nnnnnnnn 5027 days ago
The issue you refer to is in a poorly formed, ad-hoc serialization format. It has nothing to do with representation of variables at runtime. It has nothing to do with the language.

It is a programming error, not an inherent flaw in the language.

link