News for hackers. Stuff that matters.

A comment on A specific network name can completely disable Wi-Fi on your iPhone. Parent comment

Re:A specific network name can completely disable Wi-Fi on y... by pshc on Saturday June 19, 2021 @11:06PM (#27566765)
You are making a false equivalence—not all languages are equally busted. Any sanely designed modern language does not allow this to happen. Accidentally parsing a string you didn’t mean to parse is a fault of C’s outdated API design, a design flaw that keeps tripping people up again and again.
[ Parent | on HN ]
Re:A specific network name can completely disable Wi-Fi on y... by junon on Sunday June 20, 2021 @02:12AM (#27567590)
> Any sanely designed modern language does not allow this to happen

Sorry, how does Rust protect you against injection again?

[ Parent | on HN ]
Re:A specific network name can completely disable Wi-Fi on y... by melff on Monday June 21, 2021 @10:13AM (#27579373)
By requiring format strings to be literals.

https://play.rust-lang.org/?version=stable&mode=debug&editio...

[ Parent | on HN ]
Re:A specific network name can completely disable Wi-Fi on y... by pshc on Sunday June 20, 2021 @09:47AM (#27569911)
Why would Rust do anything weird when presented with the string "%p%s%s%s%s%n"?
[ Parent | on HN ]
Re:A specific network name can completely disable Wi-Fi on y... by junon on Sunday June 20, 2021 @11:36AM (#27571051)
Why would C?
[ Parent | on HN ]
Re:A specific network name can completely disable Wi-Fi on y... by pshc on Sunday June 20, 2021 @12:09PM (#27571414)
Do you want the obvious explanation? Because the string was passed into the format string parameter of some sprintf-like, a common mistake in C usually caught by warnings but seemingly ignored or suppressed in this case.

edit: turns out from the analysis it was CFStringCreateWithFormatAndArguments, so yes, a sprintf-like used incorrectly

[ Parent | on HN ]
Re:A specific network name can completely disable Wi-Fi on y... by junon on Monday June 21, 2021 @02:12AM (#27576742)
This is possible with any language. Not just C.
[ Parent | on HN ]
Re:A specific network name can completely disable Wi-Fi on y... by melff on Monday June 21, 2021 @10:15AM (#27579389)
No, Rust for example explicitly disallows this.

https://play.rust-lang.org/?version=stable&mode=debug&editio...

[ Parent | on HN ]
Re:A specific network name can completely disable Wi-Fi on y... by junon on Tuesday June 22, 2021 @02:43AM (#27588690)
You miss my point entirely.
[ Parent | on HN ]
Re:A specific network name can completely disable Wi-Fi on y... by melff on Tuesday June 22, 2021 @07:42AM (#27590441)
What is your point then?
[ Parent | on HN ]
Re:A specific network name can completely disable Wi-Fi on y... by junon on Tuesday June 22, 2021 @12:16PM (#27593553)
You can do this in any language. Rust doesn't support it with PrintLn but it's still possible with Rust. Stop acting like C did anything wrong.
[ Parent | on HN ]