Post #2931593
2026-04-01 19:29 UTC
@mudri@mathstodon.xyz Sorry if I’ve missed it, but is there a way to verify if a String has been defined in the source code… this allows a library to ensure application developers haven’t introduced any Injection Vulnerabilities with SQL, HTML, CLI, etc… e.g. verifying argument 1 to a function is an SQL string literal (a developer defined string), with user values being passed as separate arguments/parameters (not concatenated)
https://eiv.dev
Replies (1)
-
@mudri@mathstodon.xyz 2026-04-02 09:13
@craigfrancis@mastodon.social As far as I'm aware, there is indeed nothing like this. We could consider adding it, though, if the case is strong enough. My instinct would be for library APIs to deal entirely in ASTs, and never parse strings at runtime. C#'s LINQ seems to show that this is possible (even without the fancy SQL-like syntax sugar, the query builder methods seem quite serviceable and expressive). Are there problems with this, either security-wise or practically?