4 ms·
Okay so piecing this together, let me know if I am correct. The TrendMicro password manager will utilize a ShellExecute command to open a URL defined in a query
by emehrkay 11y ago
Okay so piecing this together, let me know if I am correct. The TrendMicro password manager will utilize a ShellExecute command to open a URL defined in a query string? I feel like not trusting/passing $_GET/REQUEST params was one of the first things that I learned when doing PHP development 12 years ago. Is this a concept that needs revisiting with new-age Node developers?
- kevincox 11y agoThe problem wasn't that they were trusting GET params it's that they forgot that they weren't the only ones capable of sending requests. If you wrote a website that could old be accessed by people/computers you trust then trusting the parameters is no problem. TL;DR It's not how the data is sent but where it came from.
- emehrkay 11y agoOh okay, the expectation was that the web server that the application run was to be private to the application and not anything else. I wasn't aware that apps ran their own web servers, how often is that done?
- pferde 11y agoObviously at least once too often. :)
- ptaipale 11y agoIn the Internet, you don't always note where the data comes from. I mean, software needs to do proper authentication.