3 ms·

I looked at your nod on the HN page: https://news.ycombinator.com/security.html https://news.ycombinator.com/security.html >The site name display for stories w

• dsr_ 11y ago
  The general case is that you are taking input from an untrusted source and later displaying it. You need to do two things: validate that it is the kind of data you are expecting, and scrub it of entities that might be a problem. You can't do either one of these on the browser side because a bad actor can pretend to be your code and submit it without the checks. (For good clients, you can run a check that prevents them from making simple mistakes. You can't trust that, though.) Validating that you have a correctly formatted URL is not too hard. You can even request the URL to make sure that it's reachable. But that doesn't tell you anything about the content, because evil people can't be trusted to turn on the evil flag in their packets. The safest case is to drop all submissions with IDNs; the next safest is to compile a list of homographs and drop anything with those; after that, you might keep a blacklist (which, unfortunately, can grow without reasonable bounds). You can outsource the blacklisting to centralized services checked via HTTPS API or DNS RBL or...
• pfg 11y ago
  Either block them entirely or use Punycode[1] when displaying IDNs. [1]: https://en.wikipedia.org/wiki/Punycode https://en.wikipedia.org/wiki/Punycode
  • sctb 11y ago
    Yes, we now use Punycode.