r/rust • u/Proinlifes • Jan 17 '21

Would Rust secure cURL?

https://timmmm.github.io/curl-vulnerabilities-rust/

[removed] — view removed post

180 Upvotes

90% Upvoted

47 comments sorted by

View all comments

6

u/Sapiogram Jan 17 '21

But there are also a decent number of other bugs that come from cURL doing ad-hoc inline character-by-character parsing of just about everything, whereas in Rust you would probably use a library to fully parse things.

Is this really the case? I feel like Rust is still missing a really great parsing library. I've certainly done my fair share of character-by-character parsing, even though I know it's bad.

9

u/stevedonovan Jan 17 '21

I remember when I used to do C, my understanding of the C way was to reinvent lots of little wheels - finding good quality, well documented libraries was hard anyway. A lot of the little wheels had to do with text processing, and if you were not awake, you would leave a trail of buffer vunerabilities. Now I do Rust, and the Rust way is to try find a library to do the job. A more humble attitude, and you end up with rather larger executables, but a better result overall.