From: Amirouche Boubekki <amirouche@hypermove.net>
To: Matt Wette <matt.wette@gmail.com>
Cc: guile-user@gnu.org,
guile-user <guile-user-bounces+amirouche=hypermove.net@gnu.org>
Subject: Re: Is there any security risk related to the use of the reader?
Date: Sun, 25 Feb 2018 18:38:29 +0100 [thread overview]
Message-ID: <70e7803bc07ddc477b64a405d717f6ac@hypermove.net> (raw)
In-Reply-To: <2fea5947-a129-493c-180c-18b6b89385da@gmail.com>
On 2018-02-25 18:29, Matt Wette wrote:
> On 02/25/2018 07:35 AM, Amirouche Boubekki wrote:
>> I have procedures like that in my program:
>>
>> (define-public (scm->string scm)
>> (call-with-output-string
>> (lambda (port)
>> (write scm port))))
>>
>> (define-public (string->scm string)
>> (call-with-input-string string read))
>>
>> Is it safe to pass to this procedures input from third parties?
>>
>> TIA!
>>
>
> maybe check (ice-9 sandbox), explained in section 6.18.12 of the 2.2.3
> manual
I don't know what are the performance implication to
seriallize / deserialize in a sandbox. This would slow
down every write / read.
The alternative I am thinking about is to use msgpack
but I will loose direct representation of bignum, maybe
it's a good enough strategy. People that need precision
maybe use hdf5 string representation.
next prev parent reply other threads:[~2018-02-25 17:38 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-25 15:35 Is there any security risk related to the use of the reader? Amirouche Boubekki
2018-02-25 17:29 ` Matt Wette
2018-02-25 17:38 ` Amirouche Boubekki [this message]
2018-02-25 17:35 ` Amirouche Boubekki
2018-02-25 17:35 ` Christopher Lemmer Webber
2018-02-25 17:46 ` Amirouche Boubekki
2018-02-28 22:35 ` Christopher Lemmer Webber
2018-03-01 23:56 ` Mark H Weaver
2018-03-02 3:42 ` Amirouche Boubekki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/guile/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=70e7803bc07ddc477b64a405d717f6ac@hypermove.net \
--to=amirouche@hypermove.net \
--cc=guile-user-bounces+amirouche=hypermove.net@gnu.org \
--cc=guile-user@gnu.org \
--cc=matt.wette@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).