Hello,
I need to safely parse an untrusted .txt file and extract all IP addresses contained in it. From what I can tell, Rust seems to be particularly well-suited to do this. I would use only the standard library.
Would you generally agree?
Any pointers on what to watch out for when reading an untrusted file / parsing its contents in Rust, without creating vulnerabilities (or minimizing their likelihood)?
Thank you very much.
Yes, I would generally agree.
Rust should be fine for this and the naive approach with a regex or string operations should be more than sufficient. It's not a scripting language so you don't need to worry about someone injecting a malicious eval() statement, and all you are doing is reading a file and parsing it as IP addresses, so there won't be any unsafe code to worry about.
Just make sure your code parses the file incrementally. That way you avoid running out of memory when given a really big file or a file with really long lines (check out the std::io::Read trait). Memory mapping your file can help avoid this sort of DOS attack, but it adds its own complications (e.g. you need to make sure you control the file itself so nobody can change its length and trigger a segfault or have its contents change midway through reading it).
Great, thank you, @alice and @Michael-F-Bryan!
This topic was automatically closed 90 days after the last reply. We invite you to open a new topic if you have further questions or comments.