Yes, the data has code in it...
Once that one is out, you're screwed.
That applies to most of computer science ironically.
Once that one is out, you're screwed.
That applies to most of computer science ironically.
Code is executable.
Data is not. There should be no level of turing completeness.
Taking C as an example, loading a char* with data that contains code and jumping to it or letting it overwrite the code segment is precisely where it breaks down. The same is true when your json payload contains a function or your css contains an expression.
The main problem at the moment is that technologies freely interchange the two concepts. Code should be entirely immutable once compiled and data should not be executable.
>Code is executable.
>Data is not. There should be no level of turing completeness.
I'm sorry for the defence industry.
I disclaim the use of hacks like non executable segments here in certain CPU architectures (x86 LDT/GDT controlled access bits) as they are an afterthought.
Word and Excel documents have code in them. So do PDFs and PostScript files. At this point, other than plain text everything seems to have code in it.