safely parsing maps in clojure

Question

I'm looking for an easy and safe way to parse a map, and only a map, from a string supplied by an untrusted source. The map contains keywords and numbers. What are the security concerns of using read to do this?

Answer 1

read is by default totally unsafe, it allows arbitrary code execution. Try (read-string "#=(println \"hello\")") as an example.

You can make it safer by binding *read-eval* to false. This will cause an exception to be triggered if there #= notation is used. For example:

(binding [*read-eval* false] (read-string "#=(println \"hello\")"))

Finally, depending on how you are using it there is a potential denial of service attack by supplying a large number of keywords (:foo, :bar). Keywords are interned and never freed so if enough are used the process will run out of memory. There's some discussion about that on the clojure-dev list.

Answer 2

If you want to be safe I think you basically need to parse it by hand without doing an eval. Here is an example of one way to do it:

(apply hash-map 

   (map #(%1 %2) 

        (cycle [#(keyword (apply str (drop 1 %))) 

                #(Integer/parseInt %)]) 

        (string/split ":a 23 :b 32 :c 32" #" ")))

Depending on the types of numbers you want to support and how much error checking you want to do you will want to modify the two functions that are being cycled over to process every map every other value to a keyword or number.