Hacker News Reader

Comment by wereHamster | Hacker News Reader

    "... you can write insecure code in it," he underscores his point,
    "but that's a fundamental problem in every single programming language"

No, there are languages where you can't write insecure code, where the compiler doesn't allow it and will warn you when you do.

View on HN

> there are languages where you can't write insecure code, where the compiler doesn't allow it and will warn you when you do.

Where is this wonderful language that throws compiler warnings when the code contains an SQL injection, XSS, or CSRF vulnerability?

http://www.impredicative.com/ur/

Not a complete solution, but I thought perl's "taint" feature was a brilliant idea, and I wish more languages did similar. In short, data provided by the user is automatically marked as "tainted", and cannot be passed into a shell command, an SQL string, printed into the HTML, etc, without being explicitly converted into a safe form.

(I'd particularly like it if it were possible for the user to define their own types, so we could have "raw string", "validated HTML string", "validated SQL string", etc - and also "distance in meters", "distance in feet", etc -- and it wouldn't be possible to operate on different types without explicitly converting them into compatible forms)

Ruby has it too.

Haskell with Yesod comes as close as is practical (if you explicitly tell it a string is safe to use in a certain context, it will not magically figure out that you're wrong). If you loosen the requirement to just "secure by default" rather than "insecure code fails to compile", most modern web frameworks have built-in automatic CSRF protection and default to escaping all strings when inserting them into HTML.

That's a bit of a broad statement, maybe - I'd be interested to see a general purpose language that will not allow you to write insecure software, I have a hard time believing that exists.

But you're coming from the right place - it's absolutely the job of the programming language to at least make it more difficult to do so and encouraging good security practices, and PHP does not do a very good job of that. Then again, I write JavaScript for a living so I suppose I don't have much room to criticize on that front.

Can you give an example? In the context of web development of course...

http://www.impredicative.com/ur/

http://plv.csail.mit.edu/ur/

Never heard of this language. But thanks for sharing. This is an interesting language. Not sure whether I should use it right away (always sort of tied to a certain language and ecosystem, in my case PHP) but at least we can get some inspiration from innovative approaches like this.

It's a research language and it seems very rough around the edges so using it in production might be a bad idea. That being said this is supposedly written in the language https://bazqux.com.

Probably answering my own question here but now I think of it, there is no language I can think of that catches SQL injection etc, but there seems to be server that does!

http://www.hiawatha-webserver.org/

I have no experience whatsoever with this beast but it says it kills SQL injection, XSS etc. Curious whether this would be effective.

Its been a while since I did any ASP.Net, but I remember some sort of error that would be thrown by default for common sql injection or script injection patterns on user inputs. There were still many many ways to screw things up, but this probably prevented quite a few attacks for extra lazy/ignorant coders (we have all been there at one point or another).

Not sure if I agree with OP, but this language/framework makes most common web vulnerabilities impossible: http://impredicative.com/ur/

any language could print out a hardcoded string of your root password

Reply on news.ycombinator.com