Re^5: A UTF8 round trip with MySQL

I now get the 'unchecked input' part. And I can sort of understand issues with tainting. About the C code: you're talking about C code that tries to interpret the invalid utf-8, right? Because C's basic string operations don't look at the encoding, so they are just as (un)safe when you send them a non-utf8 marked string with miscellaneous binary data in it.

update: about the (removed) line: "Another possibility is careless use of utf8::upgrade()."

That's removed because utf8::upgrade() is always safe (if you start out with valid utf-8 flags), right?

"What should it profit a man, if he should win a flame war, yet lose his cool?"

Comment on Re^5: A UTF8 round trip with MySQL

Replies are listed 'Best First'.
Re^6: A UTF8 round trip with MySQL by Juerd (Abbot) on Jun 13, 2007 at 21:12 UTC
About the C code: you're talking about C code that tries to interpret the invalid utf-8, right? Yes. I was specifically (but implicitly) referring to XS code, C code catered for Perl interaction. The UTF8 flag is interpreted as a promise that the buffer will be valid UTF8. Of course, it would be better to use Perl's macros for UTF8 handling, but that doesn't work if you're calling a library function that doesn't do SVs but does require valid UTF-8. about the (removed) line: "Another possibility is careless use of utf8::upgrade()." That's removed because utf8::upgrade() is always safe (if you start out with valid utf-8 flags), right? Exactly. The original author probably confused utf8::upgrade with Encode::_utf8_on. Juerd # { site => 'juerd.nl', do_not_use => 'spamtrap', perl6_server => 'feather' }	[reply]

Replies are listed 'Best First'.

Re^6: A UTF8 round trip with MySQL
by Juerd (Abbot) on Jun 13, 2007 at 21:12 UTC

About the C code: you're talking about C code that tries to interpret the invalid utf-8, right?

Yes. I was specifically (but implicitly) referring to XS code, C code catered for Perl interaction. The UTF8 flag is interpreted as a promise that the buffer will be valid UTF8. Of course, it would be better to use Perl's macros for UTF8 handling, but that doesn't work if you're calling a library function that doesn't do SVs but does require valid UTF-8.

about the (removed) line: "Another possibility is careless use of utf8::upgrade()." That's removed because utf8::upgrade() is always safe (if you start out with valid utf-8 flags), right?

Exactly. The original author probably confused utf8::upgrade with Encode::_utf8_on.

Juerd # { site => 'juerd.nl', do_not_use => 'spamtrap', perl6_server => 'feather' }

[reply]