2

The following sentence my friend came up with seems wrong to me:

(1) "The vulnerability is due to insufficient sanitization of user-supplied data before being used to execute commands."

Compare that with something from nytimes.com, which sounds ok:

(2) "Today, tourists go through an elaborate screening process before being allowed to visit."

In (1), "before being" connotes "A of X before X is Y", where A = insufficient sanitization, X = user-supplied data, and Y = used to execute commands

In (2), "before being" connotes "A of X before X are Y", where A = elaborate screening, X = tourists, and Y = allowed to visit.

What exactly is wrong with the grammar of (1)?

5
  • I just noticed that the object "tourists" in (2) appears at the beginning unlike in (1). I think in (1), "vulnerability", and not "user-supplied data", becomes the object of the implied pronoun. Modified question: can someone explain it clearly? – chu5eeT0 Oct 14 '14 at 17:35
  • The subject of being used is sposta be data, but the prepositional phrase doesn't modify data. It modifies sanitization, and therefore the normal rules would predict that it's the sanitization that's being used to execute commands. Simple fix is to put the subject back in: before it is used to execute commands. There's no reason to use a participle when a simple clause will do better. – John Lawler Oct 14 '14 at 17:36
  • @JohnLawler Wouldn't it be the implied subject of sanitization, or the subject of the whole main clause, i.e. vulnerability which would be regarded as the subject of being used to execute commands? Praps? (otherwise my answer below is wrong ... although I decided against mention 'subjects' of nouns ...) – Araucaria - Not here any more. Oct 14 '14 at 18:10
  • Dunno. Ask the OP. But (1) clearly implies to me that dirty data are being used to formulate commands, possibly by determining which subprogram gets executed in each case. This is a serious problem in programming if the programmer can't depend on the information being sanitized (in any of hundreds of arbitrary ways) before becoming grist for the output mill. – John Lawler Oct 14 '14 at 18:15
  • @Araucaria In my first comment, by "object" I meant "subject" (can't seem to edit the comment now). John Lawler's interpretation of (1) is correct; his simple suggestion of using "it" sounds good. Your explanation is what I was looking for. Thanks! – chu5eeT0 Oct 14 '14 at 18:51
1

Today, tourists go through an elaborate screening process before being allowed to visit.

The subordinate clause here is inside a Prepositional Phrase (some people would analyse it as being a clause with a subordinating conjunction):

  • before being allowed to visit.

Here we have to use an -ing form of the verb because there is no subject. It's the passive auxiliary BE here which is taking the -ing form. If we omit the subject we cannot use a tensed verb. If we include it we can:

  • before they are allowed to visit.

However, we can only drop the subject in a subordinate clause like this if it is the same as the subject in the main clause. If it is a different subject we can't. It we put the missing words back in to the example above, we get the following:

Today, tourists(i) go through an elaborate screening process before their(i) being allowed to visit.

Here it's clear that tourists and their are the same people. However in the other sentence in the Original Poster's first example there is a problem:

The vulnerability(i) is due to insufficient sanitization of user-supplied data(ii) before ___(ii) being used to execute commands.

Here the subject of the main clause is the vulnerability. However, the writer's intended subject of the subordinate clause is not the vulnerability but the user supplied data. The problem is user supplied data cannot grammatically be the subject here, because it isn't the subject of the main clause! Because the subjects of the two clauses are different, we cannot drop the subject in the subordinate one. The correct sentence would have to read thus:

The vulnerability is due to insufficient sanitization of user-supplied data before its being used to execute commands.

The its here is a bit ambiguous so we may prefer a tensed clause with a full subject:

The vulnerability is due to insufficient sanitization of user-supplied data before this data is used to execute commands.

0

Your structural analysis is a little off. The NYT sentence has the form A go through B before C, where B and C are a sequence of events that both happen to A. In your friend's sentence, the intended meaning is A is caused by B happening to D before C happens to D. So in the second sentence we are expecting two things that relate to A, but instead are presented with two things that relate to D, which is not conveyed correctly by the structure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.