I am currently developing some web tools (http server, peer to peer, ...) in Common Lisp, and I deal with datas such as ledger transactions for cryptocurrency systems or payments via Braintree/Paypal. Even if it is a modest personal project, I would like to provide security for it.

Excluding the security at "http protocol level", at application level, sanitizing the user input wherever I can, and not using the eval function, I am clueless with the "language and libraries level".

I use SBCL (a lisp compiler/interpreter) : http://www.sbcl.org/

...And some libraries which can call C functions at lowest level via CFFI : https://common-lisp.net/project/cffi/

What I fear is some binary or text input sent to a node or to the web server to exploit the systems in some ways. Since I have Lisp images running, the effects could be devastating, as code is data and data is code.

However, I have not found lot of information regarding the security of such technologies. I do not believe these systems are perfect regarding security, but it seems for instance that some attacks such as stack overflow are difficult to do on Lisp.

The books and whatever I find on Internet talks a lot about C systems, or PHP, SQL or that kind of technologies, which I do not use. Is there some "general advises" or algorithms on how to test, audit, develop and extend such systems, or some practices to be safe (as much as I can) ? Where can I learn to do it ? And if it does not exist, how can I create basic ways to do this ?

Thank you for your answers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.