Crystal doesn’t at present have a security model. This is most important for the web frameworks implemented in it, but I think it is general enough that it belongs in Crystal.
To solve the general issue of sanitizing input from the user before it is saved or rendered, Crystal needs
Struct taint, which of course should be copied from Ruby. This is a ton of work because it needs to be preserved across all
String operations and all string parsing operations such as
to_i . It should then be the case that objects are sanitized before being rendered or saved, unless the programmer insists.
For those unfamiliar with the Ruby implementation, input from the user got a taint bit set, which web frameworks like Rails used to prevent them from being rendered (and possibly saved) without being filtered, unless the programmer insisted. There was also a parallel feature called
trust which was less used.
Discussion of the Ruby taint/trust feature