You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
if (patt === '_') {
// Behaves like UnderscoreType
return [true, [value]];
}
What if someone would use this library to match a dynamically-constructed string with another one, which can be altered by an adversary? The adversary may be able to inject '_', and then it will be interpreted as a wildcard pattern instead of a literal value, thus resulting in a wrong clause being executed.
For people who have had experience with functional programming, the natural expectation from any pattern matching system is to abide the property:
if b is a concrete value and a is not equal to b, then match(a, b, f) will not lead to f clause execution.
Though of course it is questionable where to draw a line between concrete values and patterns, I insist that special-casing like this is not intuitive and may lead to very bad things.
Moreover, the special-case is not documented at all, which is obviously an issue on its own.
The text was updated successfully, but these errors were encountered:
This line was really scary to read:
What if someone would use this library to match a dynamically-constructed string with another one, which can be altered by an adversary? The adversary may be able to inject '_', and then it will be interpreted as a wildcard pattern instead of a literal value, thus resulting in a wrong clause being executed.
For people who have had experience with functional programming, the natural expectation from any pattern matching system is to abide the property:
Though of course it is questionable where to draw a line between concrete values and patterns, I insist that special-casing like this is not intuitive and may lead to very bad things.
Moreover, the special-case is not documented at all, which is obviously an issue on its own.
The text was updated successfully, but these errors were encountered: