3 ms·
Using string-based templating in general is a really bad practice, as it leaves the door wide open for XSS, SQL injection, etc. Sanitizing inputs, while often
by davexunit 11y ago
Using string-based templating in general is a really bad practice, as it leaves the door wide open for XSS, SQL injection, etc. Sanitizing inputs, while often cited as the proper thing to do, isn't addressing the root problem: that we're using templating systems that don't use proper data types and thus can't automatically DTRT when rendering.
See http://www.more-magic.net/posts/structurally-fixing-injection-bugs.html http://www.more-magic.net/posts/structurally-fixing-injectio... and https://www.gnu.org/software/guile/manual/html_node/Types-and-the-Web.html https://www.gnu.org/software/guile/manual/html_node/Types-an... for further explanation.
- Vendan 11y agoInterestingly, html/template does actually handle some stuff like this. Pass html in a string as a field into html/template, and it'll escape all the html automatically. In order to get the html to actually render, you have to pass it in as a `template.HTML`. There are variants of the `HTML` type for different places, including html attributes and javascript code.
- mwcampbell 11y agoAgreed. See also https://glyph.twistedmatrix.com/2008/06/data-in-garbage-out.html https://glyph.twistedmatrix.com/2008/06/data-in-garbage-out....