Re: lots of find/replace in text file
Re: lots of find/replace in text file
- Subject: Re: lots of find/replace in text file
- From: Kyle Sluder <email@hidden>
- Date: Mon, 24 Jan 2011 18:54:46 -0800
On Jan 24, 2011, at 6:02 PM, Matt Neuburg <email@hidden> wrote:
>
> (2) A common trick is make the text file a format string (i.e., containing a lot of %@) and just hand it to stringWithFormat along with all the substitutions. Badda bing badda boom.
This is how security vulnerabilities are born. You are handing off formatting strings to functions that trust you are supplying the correct number and type of arguments to match, or else they will blithely access random chunks of memory.
If you are at all accepting arbitrary input files, you must not simply hand the text over as a formatting specifier. Even if you're building an iOS app and bundling all the possible files yourself, do yourself a favor and build a more robust parser now.
There's no sense in writing intentionally fragile code that will (not "may") result in a crasher and irate customers sometime in the future when someone accidentally puts one to many %@ sequences in the MadLib file.
--Kyle Sluder
(sent from the road)_______________________________________________
Cocoa-dev mailing list (email@hidden)
Please do not post admin requests or moderator comments to the list.
Contact the moderators at cocoa-dev-admins(at)lists.apple.com
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden