TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Compile Time Prevention of SQL-Injections in Rust

56 pointsby jesperhtalmost 7 years ago

6 comments

Tuna-Fishalmost 7 years ago
This doesn&#x27;t actually work. It is possible to produce objects with &#x27;static lifetime references at runtime.<p>What &amp;&#x27;static means is that whatever the reference is pointing at will never be modified or go out of scope. One way to provide this is to put it in the read-only part of the executable, which is what literals do. Another is to use into_boxed_str() [1] and Box::leak() [2] to leak the string and thus make sure it will never be modified or freed. Neither function is unsafe, while Box::leak() is still only in nightly.<p>[1]: <a href="https:&#x2F;&#x2F;doc.rust-lang.org&#x2F;std&#x2F;string&#x2F;struct.String.html#method.into_boxed_str" rel="nofollow">https:&#x2F;&#x2F;doc.rust-lang.org&#x2F;std&#x2F;string&#x2F;struct.String.html#meth...</a> [2]: <a href="https:&#x2F;&#x2F;doc.rust-lang.org&#x2F;std&#x2F;boxed&#x2F;struct.Box.html#method.leak" rel="nofollow">https:&#x2F;&#x2F;doc.rust-lang.org&#x2F;std&#x2F;boxed&#x2F;struct.Box.html#method.l...</a>
评论 #17126635 未加载
评论 #17126624 未加载
Eridrusalmost 7 years ago
This is a pretty natural thing to want, but is not actually usable in real world settings.<p>If your SQL has to be computed at compile time, how do you implement any sort of search where you will have a variable number of ANDS &amp; ORs?
评论 #17125727 未加载
评论 #17125905 未加载
评论 #17125993 未加载
评论 #17125827 未加载
评论 #17125654 未加载
chopinalmost 7 years ago
I think the main problem (don&#x27;t know whether this is possible in Rust which I am not familiar with) is that untrusted input is passed around as strings at all (Java, which I am familiar with, does this). I&#x27;d prefer:<p>- Getting untrusted input as a separate type<p>- Having only a controlled way to put instances of this type into an SQL query
评论 #17126151 未加载
评论 #17126259 未加载
kibwenalmost 7 years ago
It&#x27;s a neat little hack, though it seems a bit restrictive. I was expecting a blog post about how, by using ownership, it should be possible to create an API that both requires untrusted data to be escaped and prevents double-escaping (though you could probably achieve pretty much the same in any statically-typed language).
alexandernstalmost 7 years ago
Is it me or the person that wrote that post has no idea what SQL inject actually is?
评论 #17125584 未加载
评论 #17125553 未加载
评论 #17125586 未加载
评论 #17125710 未加载
olavkalmost 7 years ago
Is this serious? It seems to prevent SQL injection by only allowing statically defined strings to be interpolated. So basically not allowing any kind of dynamic or user input.
评论 #17126053 未加载
评论 #17126041 未加载