Statically typed string sanitation inside a python

Abstract

Web applications must ultimately command systems like web browsers and database engines using strings. Strings derived from improperly sanitized user input can as a result be a vector for command injection attacks. In this paper, we introduce regular string types, which classify strings constrained statically to be in a regular language specified by a regular expression. Regular strings support standard string operations like concatenation and substitution, as well as safe coercions, so they can be used to implement, in an essentially conventional manner, the pieces of a web application or framework that handle strings arising from user input. Simple type annotations at function interfaces can be used to statically verify that sanitization has been performed correctly without introducing redundant run-time checks. We specify this type system first as a minimal typed lambda calculus, λ RS .To be practical, adopting a specialized type system like this should not require the adoption of a new programming language. Instead, we advocate for extensible type systems: new type system fragments like this should be implemented as libraries atop a mechanism that guarantees that they can be safely composed. We support this with two contributions. First, we specify a translation from λ RS to a calculus with only standard strings and regular expressions. Then, taking Python as a language with these constructs, we implement the type system together with the translation as a library using typy, an extensible static type system for Python.

Programmable semantic fragments: the design and implementation of typy

“…Python's complexity also makes it difficult for fragment providers to reason about correctness (relative to, e.g., an inductive specification, e.g. as in [32]) In the future, we hope to develop a dialect of typy using a reduced subset of Python (e.g. RPython [6] or λ π [57]) or a simpler language still for which a formal definition is available.…”

“…As such, when ctx.ana is called, typy follows the same protocol just described, delegating to string_in.ana_Str to analyze the string literals and to py.ana_Dict to analyze the dictionary literal. The string_in fragment implements a regex-based constrained string system, which we described, along with its implementation in typy, in a workshop paper [32]. 3 The py fragment allows dynamic Python values to appear inside typy programs, consistent with the view of Python as a statically unityped language [34,63].…”