Nice blog! Do you have a RSS feed? Can't find any...
Rust for the Web
51–60 of 100 posts
Re: Rust for the Web
#52Web developers may be also interested in https://gotham.rs/ , which was released very recently and looks to be a promising competitor to Rocket.
I'm one of the developers of Gotham. Don't hesitate to reach out if you have any questions about it.
Re: Rust for the Web
#53> NamedFile::open(Path::new("www/").join(file)).ok() Is this vulnerable to the classic "../../../../../../../etc/passwd"?
I was thinking the exact same thing. Rust being a more memory-safe language does not mean it is a secure one. Still needs proper input validation. EDIT: I opened the documentation and found https://api.rocket.rs/rocket/request/trait.FromSegments.html I don't fully understand if the checking they do on '..' fixes the attack vector here.
Based on a quick read of the source, the conversion from a "" input to a "PathBuf" type strips leading ".." components automatically.
Re: Rust for the Web
#54> NamedFile::open(Path::new("www/").join(file)).ok() Is this vulnerable to the classic "../../../../../../../etc/passwd"?
I was thinking the exact same thing. Rust being a more memory-safe language does not mean it is a secure one. Still needs proper input validation. EDIT: I opened the documentation and found https://api.rocket.rs/rocket/request/trait.FromSegments.html I don't fully understand if the checking they do on '..' fixes the attack vector here.
Slashes aren't allowed, so wouldn't be able to do any path traversals: https://api.rocket.rs/src/rocket/request/param.rs.html#298
Re: Rust for the Web
#55Earlier quoted context omitted.
I was thinking the exact same thing. Rust being a more memory-safe language does not mean it is a secure one. Still needs proper input validation. EDIT: I opened the documentation and found https://api.rocket.rs/rocket/request/trait.FromSegments.html I don't fully understand if the checking they do on '..' fixes the attack vector here.
Slashes aren't allowed, so wouldn't be able to do any path traversals: https://api.rocket.rs/src/rocket/request/param.rs.html#298
Afaik remember windows will parse additional dots beyond the two first as another level up? Cross-platform secure coding is hard... (Not sure about this code though, just making an observation).
Re: Rust for the Web
#56I built https://dtmf.io/ using Rust. The first prototype was using the Iron framework but then after fighting some parts of Iron, I pared it back to just using async hyper & handlebars-rs directly for the HTTP and templating. The glue to put them together is really minimal. Overall, I've been really impressed with Rust.
Re: Rust for the Web
#57Earlier quoted context omitted.
I'm using Rust/Rocket for Web apps and I'm as productive with that stack as I would be with, say, Go or Python/Flask. I'm more productive with Rust than I would be in Java. Programmers generally write the same amount of code (measured in LOC) per day regardless of the language, and Rust is pretty succinct. That said, I suspect if you want the absolute fastest development time, Rails and full-stack frameworks like it…
What makes you think software developers write the same average amount of lines of code per day ? It seems to me the higher level the language is, higher is the average number of loc per day. IHMO Debugging has an huge impact on this average and lower level languages are harder to debug.
Why do you say that lower level languages are harder to debug? I'd think it's the opposite.
Re: Rust for the Web
#58> NamedFile::open(Path::new("www/").join(file)).ok() Is this vulnerable to the classic "../../../../../../../etc/passwd"?
FYI, this is called a path traversal attack.
Re: Rust for the Web
#59Earlier quoted context omitted.
Speaking as an engineer who (maybe surprisingly) isn't particularly interested in type theory for its own sake, I like the fact that Rust has an expressive type/macro system and an ecosystem that takes advantage of it, yet compiles to native binaries. The low-level memory management isn't much of a problem for me since I've internalized the rules, and the same system prevents nasty problems like data races. Of course…
See the post is about using Rust on the frontend. In my opinion it is not a suitable place for Go or Rust due to their large runtimes that needs to be transpiled. Even with webassembly the Runtime size would be huge. So it is not suited for the frontend. As far as backend is concerned the decreasing order of difficulty to write the same code seems something like this to me Rust -> Haskell -> Go -> Ruby -> Clojure.
Rust does not have a large runtime.
Re: Rust for the Web
#60Earlier quoted context omitted.
I was thinking the exact same thing. Rust being a more memory-safe language does not mean it is a secure one. Still needs proper input validation. EDIT: I opened the documentation and found https://api.rocket.rs/rocket/request/trait.FromSegments.html I don't fully understand if the checking they do on '..' fixes the attack vector here.
Slashes aren't allowed, so wouldn't be able to do any path traversals: https://api.rocket.rs/src/rocket/request/param.rs.html#298
> On Windows, decoded segment contains any of: '\'
And on Japanese and Korean windows? It uses the yen symbol as path separator. Depending on how the path is read or interpreted, filtering the yen may be necessary.
https://msdn.microsoft.com/en-us/library/dd374047(v=vs.85).a...