一句话：提出安全解析器 DSL Daedalus，基于函数式解析组合子与流操作构造，可生成多语言安全解析器。
现实中的安全攻击仍常利用解析器漏洞，原因包括内存安全问题、输入校验缺陷和对冗长标准的误读，维护成熟数据格式的解析器仍很困难。Daedalus 是面向安全解析器编写的 DSL 与工具链，基于函数式解析组合子并加入流操作等领域构造，以自然表达非连续格式；它在表达力与领域构造间平衡，使规约简洁且便于分析。该独立 DSL 可为 C++ 和 Haskell 生成安全解析器。作者用其实现 20 种格式，包括 PDF 和 NITF，评估显示解析器简洁且性能良好。PDF 是最大案例，与 PDF Association 合作的参考实现在红队测试中是唯一未发现缺陷的 PDF 解析器。
Despite decades of contributions to the theoretical foundations of parsing and the many tools available to aid in parser development, many security attacks in the wild still exploit parsers. The issues are myriad—flaws in memory management in contexts lacking memory safety, flaws in syntactic or semantic validation of input, and misinterpretation of hundred-page-plus standards documents. It remains challenging to build and maintain parsers for common, mature data formats. In response to these challenges, we present Daedalus, a new domain-specific language (DSL) and toolchain for writing safe parsers. Daedalus is built around functional-style parser combinators, which suit the rich data dependencies often found in complex data formats. It adds domain-specific constructs for stream manipulation, allowing the natural expression of parsing noncontiguous formats. Balancing between expressivity and domain-specific constructs lends Daedalus specifications simplicity and leaves them amenable to analysis. As a stand-alone DSL, Daedalus is able to generate safe parsers in multiple languages, currently C++ and Haskell. We have implemented 20 data formats with Daedalus, including two large, complex formats—PDF and NITF–and our evaluation shows that Daedalus parsers are concise and performant. Our experience with PDF forms our largest case study. We worked with the PDF Association to build a reference implementation, which was subject to a red-teaming exercise along with a number of other PDF parsers and was the only parser to be found free of defects.
@article{DiatchkiDGHHRSW24,
title = {Daedalus: Safer Document Parsing},
author = {Iavor S. Diatchki and Mike Dodds and Harrison Goldstein and Bill Harris and David A. Holland and Benoit Razet and Cole Schlesinger and Simon Winwood},
journal = {Proceedings of the ACM on Programming Languages},
volume = {8},
number = {PLDI},
year = {2024},
doi = {10.1145/3656410}
}