Re: [NASL2] Auto-conversion with + and -
"Pavel Kankovsky" <[email protected]>
| Newsgroups | gmane.comp.security.nessus.devel |
|---|---|
| Message-ID | <[email protected]> |
On 8 Feb 2003, Michel Arboi wrote: > Unfortunately, string() does more than converting its arguments to > ASCII: it interprets escape sequences in "impure strings". BTW: what happens when you use + to concatenate a pure string and an impure string? Will the result be pure? Impure? Will the impure argument be auto-purified? I think the whole concept of pure/impure strings creates considerably more problems than it solves. Is there any script that (really) needs to work with impure strings (I mean doing things like x = "n"; y = "\" + x; z = string(y))? I doubt there is any. I suggest to get rid of impure strings completely and interpret escape sequences in string literals. I even volunteer to examine all scripts and double every backslash that should be interpreted as a backslash. :) > Here is my proposal, for the moment: I add a BIG warning when + or - > arguments are converted. We wait for a while, and if all the current > scripts are OK, we remove the "auto conversion" and returns an error. I agree. --Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ] "Resistance is futile. Open your source code and prepare for assimilation."