String is not a sufficient type: how using your type system can help you make better software

We deal with types, explicitly or implicitly—depending on our language of choice—every day. We often use them without even thinking about them, or we consider them an annoyance when we’re just trying to get something done. This brief talk presents an accessible metaphor to help explain that type systems are here to help us, and it makes a case for using more—not fewer—types in everyday programming in order to create more stable, more secure software.

A video of this talk is available: https://vimeo.com/148532355

And speakers’ notes, etc are on my blog: https://www.dzombak.com/talks/2015-12-10-String-is-not-a-sufficient-type--how-using-your-type-system-can-help-you-make-better-software.html

Transcript

1. String is not a sufficient type (how using your type system can help you make better software)
2. About Me → Chris Dzombak → iOS Frameworks Team → dzombak@nytimes.com → @dzombak on Slack → @cdzombak on Twitter
3. Relax.
4. Let’s talk about String.
5. → user input → human language words → output for the UI → SQL statements → keypaths for Cocoa KVO/KVC → …
6. → … → XPath queries for XML → shell commands → HTML → regular expressions → and more!
7. String is totally insufficient to represent all these different things
8. Documentation
9. SQL Injection SELECT * FROM items WHERE owner = 'hacker' AND itemname = 'name'; DELETE FROM items; --'
10. Shell Injection run("gpg" , "−−trust−model always −o \"#{File.expand_path(dst.path)}\" −e −r \"#{@recipient}\" \"#{File .expand_path(src .path)}\"") Code sample from the 2010 DC online voting pilot1. 1 https://jhalderm.com/pub/papers/dcvoting-fc12.pdf https://freedom-to-tinker.com/blog/jhalderm/hacking-dc-internet-voting-pilot
11. Messy UI failure modes
12. XSS
13. What if we used different String types for… → user input → HTML output → SQL statements → shell commands → etc…
14. let username = inputUsername() let sql: SQLString = "SELECT FROM `users` WHERE `name` = '" + username + "';" database.execute(sql)
15. let username = inputUsername() let sql: SQLString = "SELECT FROM `users` WHERE `name` = '" + username + "';" > error: ^^^ > error: cannot combine `username` of type UserInputString with type SQLString
16. I’m not crazy.
17. 43,560
18. 43,560 43,560 ft²
19. Units in math are just like your type system.
20. Units in math are just like your type system.
21. Exactly like in high school physics, we should attach meangingful information to our strings.
22. Exactly like in high school physics, we should attach meangingful information to our strings. Then, our compiler or runtime will make many common mistakes impossible.
23. What would it take to really do this?
24. Standard library → String → UserInputString → PathString and URLString → (or maybe filesystem paths and URLs should be represented by separate, more capable objects entirely)
25. Native UI library → UserFacingString → A function accepting Strings, numbers, null references; filtering them; and outputting a “sane” string
26. Web templating library → HTMLEscapedString → A function accepting other Strings and escaping them for output
27. Database library → SQLStatement, SQLEscapedString → SQLStatement may only be constructed from programmer-controlled origins → Only SQLEscapedString may be combined into SQLStatement, in predefined safe ways → A function accepting Strings and escaping them for SQL
28. Cocoa KVC/KVO → KeyPath → addObserver:forKeyPath:… et al. accept KeyPath → Build KeyPath from string literals, with validation → Build KeyPath from runtime reflection → KeyPath instances can only be manipulated in constrained, valid ways
29. This sounds hard !
30. This sounds hard !
31. Using plain old String everywhere in your program is like a professional physicist foregoing units in their calculations.
32. This is work we’re doing already.
33. This is work we’re doing already. Except when we forget.
34. This is work we’re doing already. → ESAPI.encoder() → mysql_real_escape_string (yes, I know it’s deprecated) → Escaping shell metacharacters2 → label.text = name.length ? name : "" 2 http://stackoverflow.com/a/20053121
35. Implementation?
36. Implementation? ¯\_(ϑ)_/¯
37. Conclusions Type systems exist and we should let them help us. ✅
38. Conclusions A few new types would help eliminate whole classes of vulnerabilities and other bugs. ✅
39. Conclusions This wouldn’t be hard or annoying; this is work we’re already doing. ✅
40. Discussion