Hacker News Reader

Comment by schemescape | Hacker News Reader

Is there anything similar for Common Lisp?

For now, I’m using JSON because I’m paranoid about code injection attacks around print/read.

I’ve seen a handful of libraries, but each one claims to protect against a different kind of attack, so that makes me think they might be vulnerable to the ones they don’t mention.

Edit: I’m not sure if I understood this submission properly, but I’ll leave my question up since I’m still interested.

Edit again: looks like someone asked this exact question on SO: https://stackoverflow.com/questions/34813891/how-do-you-secu...

View on HN

I think this should be safe: https://github.com/phoe/safe-read

This doesn’t provide such functionality out of the box, but it makes it pretty trivial to produce a custom READ that only has the features you want: https://github.com/s-expressionists/Eclector

It’s not exactly the right input format, and has a couple outstanding performance issues, but I wrote a parser for EDN which should be safe against code injection: https://github.com/fiddlerwoaroof/cl-edn

Thanks! safe-read and this other one are what I’d seen before: https://github.com/mabragor/cl-secure-read

I’ll look at them more closely.

JSON and this should be isomorphic if you squint a bit. You shouldn’t use eval for parsing sexps from the network in the same way you shouldn’t eval json in JavaScript (obvious yes I know but the solution is the same - use a parser instead)

Right, that’s why I was asking if there was some sort of lossless encoding for simple Lisp types (“simple” I’m leaving undefined for now).

For now, I encode everything as JSON, then decode back into lists, etc. on the other side (using cl-json). I was hoping there might be something more direct. But who knows, maybe the JSON libraries are so optimized they’re faster anyway!

The solution is to not use the reader and instead write a parser yourself. S-Expressions are really simple, you should be able to do that quite easily.

I was hoping it was easy enough that someone had already done it :)

Escaping strings and parsing floating point numbers isn’t something I enjoy.

Why would you want to transmit s-exps over a network? What's wrong with HTTPS or TCP/TLS?

I meant over HTTPS.

What's the realistic issue with code injection over HTTPS TCP parsing into expected messages? If it is an issue for your system, can't you try read into some expected shape and throw an error if it doesn't parse to circumvent that?

I was specifically talking about Common Lisp’s print/read functions which are not safe for untrusted input:

https://github.com/salewski/cl-safe-read/blob/master/README....

Reply on news.ycombinator.com