Re:We don't need runtime type checks
by olliej on Thursday March 03, 2022 @07:09PM
(#30548831)
"the end result is the program crashing" is purely a byproduct of the type error being unintentional.
It should not be surprising that an attacker payload will be designed to ensure that the type error does not cause your service to crash (at least not immediately).
Additionally the type errors that you hit are likely fairly shallow: they're a product of using the wrong request in your generated user facing site which will show up pretty much immediately.
A dynamic language without the type checks has the memory safety properties of C (I think I could make an argument that it's worse)
It should not be surprising that an attacker payload will be designed to ensure that the type error does not cause your service to crash (at least not immediately).
Additionally the type errors that you hit are likely fairly shallow: they're a product of using the wrong request in your generated user facing site which will show up pretty much immediately.
A dynamic language without the type checks has the memory safety properties of C (I think I could make an argument that it's worse)