Daedalus: Safer Document Parsing

• Published in: Proceedings of ACM on programming languages Vol. 8; no. PLDI; pp. 816 - 840
• Main Authors: Diatchki, Iavor S., Dodds, Mike, Goldstein, Harrison, Harris, Bill, Holland, David A., Razet, Benoit, Schlesinger, Cole, Winwood, Simon
• Format: Journal Article
• Language: English
• Published: New York, NY, USA ACM 20.06.2024
• Subjects: Domain specific languages; Functional languages; Parsers; Parsing; Program analysis; Software and its engineering; Theory of computation; NITF; PDF; Format definition languages; binary data formats
• DOI: 10.1145/3656410
• ISSN: 2475-1421

Despite decades of contributions to the theoretical foundations of parsing and the many tools available to aid in parser development, many security attacks in the wild still exploit parsers. The issues are myriad—flaws in memory management in contexts lacking memory safety, flaws in syntactic or semantic validation of input, and misinterpretation of hundred-page-plus standards documents. It remains challenging to build and maintain parsers for common, mature data formats. In response to these challenges, we present Daedalus, a new domain-specific language (DSL) and toolchain for writing safe parsers. Daedalus is built around functional-style parser combinators, which suit the rich data dependencies often found in complex data formats. It adds domain-specific constructs for stream manipulation, allowing the natural expression of parsing noncontiguous formats. Balancing between expressivity and domain-specific constructs lends Daedalus specifications simplicity and leaves them amenable to analysis. As a stand-alone DSL, Daedalus is able to generate safe parsers in multiple languages, currently C++ and Haskell. We have implemented 20 data formats with Daedalus, including two large, complex formats—PDF and NITF–and our evaluation shows that Daedalus parsers are concise and performant. Our experience with PDF forms our largest case study. We worked with the PDF Association to build a reference implementation, which was subject to a red-teaming exercise along with a number of other PDF parsers and was the only parser to be found free of defects.