Early return and comment out in languages without closing comment token?

[security-curious]

Do the early return and comment out technique depend to the language to be able to close the comment? I noticed all the examples use those type of languages. Take Ruby for example. The only types of comments allowed in Ruby are ones that comment all the way until the end of the newline:

puts 'hello world' # here is a comment

Or for multi-line comments you can use this syntax but the =begin and =end must be at the start of a line so using =end in the middle of a line would not work:

puts 'hello world'
=begin
a multi
line comment
=end

There are a number of other languages out there that don't support /* comments with a closing token */ and I'm wondering if all those languages would be safe from the early return or comment out attack?

[nickboucher]

This is a fantastic topic, and my inclination is to say the answer is "yes". As you imply, the stretched string technique should work as long as the interpreter supports the Unicode tokens (although I haven't tested anything in Ruby).

That said, there may be other (perhaps Ruby-specific ways) of implementing early-return and commenting-out attacks. If so, I'd be interested to see what they and if they generalize to other language settings.

Let's leave this issue open and see if anyone has any Ruby-specific suggestions for techniques that could implement these two attacks.

[security-curious]

Played with this a bit and you are correct. While a lack of closing comment may make it impossible in some languages other Ruby-specific features make it possible in Ruby. In #9 we talked about an identifier having control codes. If we make a variable entirely control codes it becomes invisible. What I wanted to do was this:

<ctrl-codes>; return # <ctrl-codes>

Basically put two statements on the same line. One that is useless just to start the control codes. End the statement and then put my return followed by the comment and control codes so I can move my useless statement to the comment. This didn't quite work out because my local variable was not initialized causing an error. Therefore I assigned it one of the values that came into the function. Still a useless statement but it makes it run:

<ctrl-codes> = amount; return # <ctrl-codes>

The ; really stands out but we can use the logical and operator as an alternate method of joining two statements on the line to give the comment a more natural token. Final result:

$bank = { 'alice' => 100 }

def subtract_funds account, amount
  ⁧⁦ = amount and return # ⁩⁦# Subtract from acct the value⁩⁩
  $bank[account] -= amount
end

subtract_funds 'alice', 50

If it wasn't for the syntax highlighting it would be a pretty convincing early return. We can do a similar trick for comment out:

is_admin = false
⁧⁦ = true; #⁩⁦if is_admin       # Begin block if is_admin⁩⁩
  puts 'You are an admin'
⁧⁦ = true;   #⁩⁦end               # End block if is_admin ⁩⁩

To answer my own question, I think the general answer is languages without a closing comment token are safe from these two strategies but other language characteristics may enable them again. Going to go ahead and close this issue since I think it's fairly well explored.