Re: String tainting

["Dirk Feytons" <dirk.feytons@...>]

That was my first idea but it doesn't work because metamethods are not
invoked for "foo".."bar". They are only used when the operands aren't
strings or numbers. That's what I meant with the concatenation being
hardwired in the VM (luaV_concat).

-- 
Dirk

On Feb 8, 2008 12:32 PM, Stefan Sandberg <keffo.sandberg@gmail.com> wrote:
> Perhaps some __concat tweaking is in order?
>
>
> Dirk Feytons wrote:
> > Hi,
> >
> > I've been looking into adding some support for string tainting. In
> > short I want to be able to (un)taint a string and find out whether a
> > string is tainted or not. This would allow me to mark certain strings
> > tainted in one place and do something different with them somewhere
> > else.
> > A trivial implementation in Lua is something like:
> >
> > ----- taint.lua -----
> > local tainted = {}
> > local strlib = getmetatable("")["__index"]
> > strlib["taint"] = function(s)
> >   tainted[s] = true
> > end
> >
> > strlib["untaint"] = function(s)
> >   tainted[s] = nil
> > end
> >
> > strlib["istainted"] = function(s)
> >   return tainted[s] == true
> > end
> > ----- taint.lua -----
> >
> > Works fine for trivial cases but it fails in combination with string
> > concatenation through .. or table.concat(). I can probably get
> > table.concat() to work but .. is more problematic since it is
> > hardwired into the VM. Has anybody ever done something similar? Any
> > implementation ideas or pitfalls to watch out for if I go hack on the
> > VM?
> >
> >
>
>