4 ms·
Your demo needs fixing, it's open to XSS and that has been tried and tested, as expected for this crowd. :)
by juretriglav 11y ago
Your demo needs fixing, it's open to XSS and that has been tried and tested, as expected for this crowd. :)
- g_delgado14 11y agoAs a curious noob, could u explain what is the source of the XSS vulnerability in this case? Is it simply that the site isn't being served over tls/ssl?
- rohanprabhu 11y agoNot sanitizing input, by either scrubbing out any <script> tags, or escaping those characterst to html entities.
- kolme 11y agoPlease don't "sanitize" input, just escape accordingly. "<script>" might be a legitimate input.
- eterm 11y agoYou need both. Sometimes the legit input is HTML such as from rich text editors. In those cases if someone types a bold <script> then the form should submit the escaped <b><script><b> but also needs to sanitise to make sure that other HTML element types are not present. If you escape one step further you'll lose formatting or the message, so sanitisation is important too, it is reductive to say "always escape never sanitise".
- windsurfer 11y agoI think your first problem is whitelisting HTML entities. Unless you're composing HTML-formatted email, it's usually better to use a different markup syntax like a minimal markdown or asciidoc that can safely be escaped.
- eterm 11y agoI agree, although for non-technical users, the better wysiwyg editors are still HTML based, unless you have a recommendation for an in-browser wysiwyg editor that returns/exports markdown?
- deleted 11y ago[deleted]
- fauria 11y agoMERN scaffolded apps depend on Mongoose. I wrote a plugin that maybe could fix that, its called mongoose-sanitizer: https://www.npmjs.com/package/mongoose-sanitizer https://www.npmjs.com/package/mongoose-sanitizer
- webcc 11y agoOh yes, XSS attack on a bare minimum blog app! There's a reason why its called starter app!
- pc86 11y agoMight as well just store credit card info and passwords in plain text while we're at it. Starter app! Disruption!
- webcc 11y agoPrecisely my point, who the hell stores credit card info in a f*ing starter app! And your obsession about seeing a disruption in every damn thing!
- tonyarkles 11y agoThis sub-thread is a little snippy, but it seems like a good opportunity to mention something I mention to a lot of people. Sample code is documentation. For a lot of users, the sample code is the only documentation they're going to read when they're starting out. If you consider that, doing it the right way in your sample code is critical. Further, it feels a lot like false advertising. If input validation is awkward in your framework, and I don't discover that until later on down the road, I'm probably going to feel deceived. If the "demo code" is a screenful of code, and doing the same activity but doing it in a secure way (i.e. no XSS, etc) results in 10 screenfuls of code, I'm going to feel that either: a) the author of the framework doesn't know what they're doing, or b) they were trying to make the framework look super minimal, when it actually requires the same amount of boilerplate junk that everyone else requires. Either way, I'm not going to be super pleased. Just show it the right way upfront!