Security and programming languages(5)

• Design related security problems:

  • untrusted input (from a large number of sources)
  • race conditions
    • access() followed by open()
    • /tmp files
    • signals
  • encoding/decoding/quoting:
    • HTTP: %-encoding, +'s
    • quoting dangerous characters with '\'