Skip to content

fix: validate the user inputs and add documentation for the CLI #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

aminya
Copy link

@aminya aminya commented May 6, 2024

Fixes #16

@aminya
Copy link
Author

aminya commented May 19, 2024

@lefticus Could you take a look at this? The user input verification is quite important in terms of security.

@aminya
Copy link
Author

aminya commented Oct 1, 2024

@lefticus A kind reminder on this if you have missed it. These security issues are important.

@lefticus
Copy link
Owner

lefticus commented Nov 1, 2024

@aminya since invalid input would result in generated code that cannot compile, I'm curious how this qualifies as a security issue. Could you provide an example for how invalid input can generate code that compiles and is dangerous or in some way compromises the generator itself?

@aminya
Copy link
Author

aminya commented Nov 1, 2024

@aminya since invalid input would result in generated code that cannot compile, I'm curious how this qualifies as a security issue. Could you provide an example for how invalid input can generate code that compiles and is dangerous or in some way compromises the generator itself?

Fortunately, the generated code does not seem to be affected. However, the json2cpp CLI itself still segfaults, and if in some situations it is exposed to receive user input, it can allow access to the memory.

This PR also solves the usability issue for developers. Previously, the failures were silent or could result in segfaults.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Segmentation fault when using incorrect CLI arguments
2 participants