Re: Web Development Using Ada?

["Randy Brukardt" <randy@rrsoftware.com>]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1437 bytes --]

"Yannick Duchêne (Hibou57)" <yannick_duchene@yahoo.fr> wrote in message 
news:op.w0w1zhgxule2fv@cardamome...
Le Sun, 28 Jul 2013 05:03:51 +0200, Randy Brukardt <randy@rrsoftware.com>
a écrit:
>> OTOH, if you execute a shell, if an attacker can find a way to pass
>> information to that shell, they might be able to do anything. Apache has
>> fixed many such bugs. It's better if there are no shell outs. It's even
>> better if the capability to do shell outs isn't even in the code (since 
>> some
>> attacks require executing existing code in unusual ways - if the process
>> doesn't have any code that can shell out, such attacks can't shell out
>> either).
>
>What's "shell out" in this context? A server or anything responding to a 
>request, has no reasons to have any connexions to the shell.

Anything that requires executing another piece of code (for instance, 
launching a Python interpreter to execute Python code). If one keeps the 
entire server in Ada, then the capability of launching another program is 
not even in the code, making attacks via return modification impossible (and 
these are the attacks which get around techniques to prevent code injection, 
such as DEP on Windows).

                                  Randy.


-- 
"Syntactic sugar causes cancer of the semi-colons." [1]
"Structured Programming supports the law of the excluded muddle." [1]
[1]: Epigrams on Programming - Alan J. - P. Yale University