Re (tilly) 1: Two-arg open() considered dangerous

Replies are listed 'Best First'.
Re: Two-arg open() considered dangerous by Dominus (Parson) on Dec 12, 2001 at 21:05 UTC
Says Tilly: Essentially any API which make data and metadata easily confused should be viewed with suspicion. Dan Bernstein says something similar in his explanation of the design of `qmail`: Don't parse. I have discovered that there are two types of command interfaces in the world of computing: good interfaces and user interfaces. The essence of user interfaces is parsing: converting an unstructured sequence of commands, in a format usually determined more by psychology than by solid engineering, into structured data. When another programmer wants to talk to a user interface, he has to quote: convert his structured data into an unstructured sequence of commands that the parser will, he hopes, convert back into the original structured data. This situation is a recipe for disaster. The parser often has bugs: it fails to handle some inputs according to the documented interface. The quoter often has bugs: it produces outputs that do not have the right meaning. Only on rare joyous occasions does it happen that the parser and the quoter both misinterpret the interface in the same way. When the original data is controlled by a malicious user, many of these bugs translate into security holes. Some examples: the Linux `login -froot` security hole; the classic `find \| xargs rm` security hole; the Majordomo injection security hole. Even a simple parser like getopt is complicated enough for people to screw up the quoting. In qmail, all the internal file structures are incredibly simple: text0 lines beginning with single-character commands. (text0 format means that lines are separated by a 0 byte instead of line feed.) The program-level interfaces don't take options. All the complexity of parsing RFC 822 address lists and rewriting headers is in the qmail-inject program, which runs without privileges and is essentially part of the UA. Looked at from Dan's point of view, the second argument of two-argument `open` is part of the user interface, a piece of unstructured data (a string) which Perl must parse into structured data (a record that lists the filename and the open mode). A program that wants to use `open` to open a certain filename with a certain mode must quote this information, turning it into a string, which is then given to `open`, which then parses it back into a name and a mode. As Dan predicts, the quoting and parsing processes don't always interpret the interface in the same way. Three-argument `open` allows the structured data to remain more structured throughout, because the mode and filename never need to be combined into a single unstructured string. -- Mark Dominus Perl Paraphernalia	[reply]
Re (chip): Two-arg open() considered dangerous by chip (Curate) on Dec 12, 2001 at 03:53 UTC
Incidentally, I'd say that this tilly quote deserves preservation: Any API which make data and metadata easily confused should be viewed with suspicion. -- tilly -- Chip Salzenberg, Free-Floating Agent of Chaos	[reply]
Re (chip): Two-arg open() considered dangerous by chip (Curate) on Dec 12, 2001 at 03:50 UTC
I agree that three-arg open is a bit new to depend on, but sysopen may not be inconvenient. Specifically, it's guaranteed{1} that `O_RDONLY`, `O_WRONLY`, and `O_RDWR` have the values zero, one, and two, respectively. So `sysopen FOO, $file, 0` should work everywhere in the known universe. {1} This is OK to count on because the C function open() originates with Unix, and for backwards compatibility with ancient UNIX code, the second parameter of open() must accept zero/one/two. -- Chip Salzenberg, Free-Floating Agent of Chaos	[reply] [d/l] [select]
Re (tilly) 3: Two-arg open() considered dangerous by tilly (Archbishop) on Dec 12, 2001 at 03:54 UTC
It is not guaranteed. From 'perldoc -f sysopen' on 5.005_03 I get: =item sysopen FILEHANDLE,FILENAME,MODE =item sysopen FILEHANDLE,FILENAME,MODE,PERMS [ snip ] The possible values and flag bits of the MODE parameter are system-dependent; they are available via the standard module C<Fcntl>. For historical reasons, some values work on almost every system supported by perl: zero means read-only, one means write-only, and two means read/write. We know that these values do I<not> work under OS/390 & VM/ESA Unix and on the Macintosh; you probably don't want to use them in new code. [download] So those values probably work. But not always.	[reply] [d/l]
Re (chip): Two-arg open() considered dangerous by chip (Curate) on Dec 12, 2001 at 03:58 UTC
Damn. I had no idea that there were systems that broken that could still run a modern Perl. -- Chip Salzenberg, Free-Floating Agent of Chaos	[reply]
(ichimunki) re: Two-arg open() considered dangerous by ichimunki (Priest) on Dec 13, 2001 at 04:46 UTC


XP is just a number
	PerlMonks