Generate Parsers! Prevent Exploits!

on YouTube ↗27m

" summary

Claim: tailored parsers stop exploits by preventing unexpected computation at the input boundary. Implementation: a Ruby schema‑based parser generator called Muskox parser generator uses Ruby metaprogramming to produce a tokenizer plus validator that recognizes JSON tokens, rejects invalid input before creating Ruby objects, and returns structured error info instead of letting malformed input reach app logic. Goal: match the ergonomics of Rails 4's Strong Parameters while replacing early framework parsing; Rails extension is promising but not finished.

AI-written summary · about

" chapters (17)

1. 0:00Start
2. 2:24UNEXPECTED COMPUTATION!
3. 2:55HOW DOES AN EXPLOIT WORK?
4. 3:24EXPLOIT ANATOMY
5. 5:55EXAMPLE: RAILS XML(TYPE=YAML)
6. 7:32WHAT'S THE REAL PROBLEM HERE?
7. 7:44NO BAD INPUT ALLOWED!
8. 8:12LANGUAGE THEORETIC SECURITY
9. 9:21ARE YOU TALKING ABOUT DECIDABILITY?
10. 9:37CHAPTER 0: DECIDABILITY
11. 10:26HALTING PROBLEM
12. 11:01UNDECIDABLE PROBLEMS EXIST WHAT ABOUT INPUT VALIDATION?
13. 11:57CHAPTER 1: FORMAL LANGUAGES
14. 15:38CONTEXT FREE HAS TWO PARTS
15. 15:51DETERMINISTIC CONTEXT-FREE COMPARING PARSER EQUIVALENCY
16. 23:31MUSKOX IS A SCHEMA BASED PARSER GENERATOR
17. 25:00REPLACE STRONG PARAMS

" related talks

• 32mParsing RubyKevin Newton · RubyConf 2021
• 32mTime flies like an arrow; Fruit flies like a banana: Parsers for Great GoodHsing-Hui Hsu · RubyKaigi 2015
• 43mGrammars, Parsers, and Interpreters, In RubyMichael J. I. Jackson · RubyConf 2010
• 46mGrammar a BNF like Ruby DSL ParsingEric Mahurin · Lone Star Ruby Conference 2008
• 51mForbidden Fruit: A Test of Ruby's Parse TreeChris Wanstrath · GORUCO 2008
• 38mParsing Expressions in RubyMichael J. I. Jackson · MountainWest RubyConf 2011
• 54mHacking parse.yTatsuhiro Ujihisa · RubyConf 2009
• 40mRuby Writing MachinesMark Rickerby · Kiwi Ruby 2017