Uploaded image for project: 'Clojure'
  1. CLJ-2312

Avoid using keywords as sentinel values in transducers

    Details

    • Type: Bug
    • Status: Open
    • Priority: Minor
    • Resolution: Unresolved
    • Affects versions: Release 1.9, Release 1.7, Release 1.8
    • Fix versions: None
    • Environment:

      All environments

      Description

      The use of keywords as sentinels in transducers could in rare circumstances expose some applications to bugs and potential security risks.

      (sequence (partition-by keyword) ["1" "none" "2" "clojure.core/none" "3" "4"])
      ;(["1"] ["none"] ["2"] ["clojure.core/none" "3"] ["4"])
      

      Ideally a private or local value that cannot be injected into the functions domain should be used instead, e.g. (Object.).

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              rickmoynihan Rick Moynihan
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated: