Skip to content

adds more language about interfacing between memory safe by default a… #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Mar 20, 2025
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions docs/memory-safety-continuum/memory-safety-continuum-draft2.md
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,9 @@ While new software is increasingly being written in memory safe by default langu

It is and will continue to be necessary for software written in memory safe by default languages to interact with software written in non-memory safe by default languages through foreign function interfaces (FFI). FFI is one of the primary uses for unsafe blocks within Rust (as well as within other languages).

[TO DO: Expand on this and collect best practices]
There are some general best practices for interfacing between memory safe by default and non-memory-safe by default languages, as well as language-ecoystem specific practices. We have captured these enhancements - both general and language ecosystem specific - in this [list of best practices](https://github.com/ossf/Memory-Safety/blob/main/docs/best-practice-interfacing.md).

We expect further developments in this space and will update this continuum as they emerge.

### 3. Using Non-Memory Safe By Default Languages

Expand Down Expand Up @@ -101,15 +103,12 @@ The amount software that has already been produced is staggering - and it is onl
* Using a mutation tester such as [cargo-mutants](https://github.com/sourcefrog/cargo-mutants)
* Using [CodeQL](https://codeql.github.com/) for the [languages that CodeQL supports](https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/)
* Using [DevSkim](https://github.com/microsoft/devskim) IDE extensions/language analyzers
* [More best practices](https://github.com/ossf/Memory-Safety/blob/main/docs/best-practice-memory-safe-by-default-languages.md)

#### Memory safe by default language automated tooling to provide additional checks to your dependencies

* Using a fuzzer such as [AFL++](https://github.com/AFLplusplus/AFLplusplus) on both your own code and third party code

### 2. Using Memory Safe by Default Languages to interface with Non-Memory Safe By Default Languages

TO DO

### 3. Using Non-Memory Safe By Default Languages

#### Non-memory safe by default language ecosystem best practices
Expand All @@ -119,6 +118,7 @@ TO DO
* Using the [C++ Compiler Hardening Guide](https://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/Compiler-Hardening-Guides) when compiling C++ code
* Isolating code that processes un-trusted data from code that performs direct memory management operations or uses raw pointers (see [Language-theoretic Security](https://github.com/ossf/Memory-Safety/pull/20))
* Using [smart pointers](https://learn.microsoft.com/en-us/cpp/cpp/smart-pointers-modern-cpp?view=msvc-170)
* [More best practices](https://github.com/ossf/Memory-Safety/blob/main/docs/best-practice-non-memory-safe-by-default-languages.md)

#### Non-memory safe by default language automated tooling to provide additional checks to your code

Expand All @@ -131,6 +131,7 @@ TO DO
* Using [CodeQL](https://codeql.github.com/) for the [languages that CodeQL supports](https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/)
* Using [BinSkim](https://github.com/microsoft/binskim) to analyze binaries
* Using [DevSkim](https://github.com/microsoft/devskim) IDE extensions/language analyzers
* [More best practices](https://github.com/ossf/Memory-Safety/blob/main/docs/best-practice-non-memory-safe-by-default-languages.md)

#### Non-memory safe by default language automated tooling to provide additional checks to your dependencies

Expand Down