Re: [NASL2] Auto-conversion with + and -

"Pavel Kankovsky" <[email protected]>
Newsgroups gmane.comp.security.nessus.devel
Message-ID <[email protected]>
On 8 Feb 2003, Michel Arboi wrote:

> Unfortunately, string() does more than converting its arguments to
> ASCII: it interprets escape sequences in "impure strings".

BTW: what happens when you use + to concatenate a pure string and an
impure string? Will the result be pure? Impure? Will the impure argument
be auto-purified?

I think the whole concept of pure/impure strings creates considerably more
problems than it solves. Is there any script that (really) needs to work
with impure strings (I mean doing things like x = "n"; y = "\" + x; z =
string(y))? I doubt there is any.

I suggest to get rid of impure strings completely and interpret escape
sequences in string literals. I even volunteer to examine all scripts and
double every backslash that should be interpreted as a backslash. :)

> Here is my proposal, for the moment: I add a BIG warning when + or -
> arguments are converted. We wait for a while, and if all the current
> scripts are OK, we remove the "auto conversion" and returns an error.

I agree.

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.