3 ms·
You need to use something that represents the HTML tree using real data types. I do a lot of my work in Scheme, where we have SXML: '(p "hello" (strong "j
by davexunit 11y ago
You need to use something that represents the HTML tree using real data types. I do a lot of my work in Scheme, where we have SXML:
'(p "hello" (strong "jamespo"))
Before you say "ahhh the parens!", there are special readers such as Racket's Pollen that provide a less Lispy, but still powerful, language for writing documents.
For JavaScript, there's of course a bunch of options such as Mithril:
m("p", ["hello", m("strong", "jamespo")]);
I don't write Go so I don't know what the options are there. Just trying to raise awareness for safer programming.
For much more in-depth information about the problem, see: http://www.more-magic.net/posts/structurally-fixing-injection-bugs.html http://www.more-magic.net/posts/structurally-fixing-injectio...