5 ms·
I like the idea of providing such a list for testing purposes. I also like the idea of storing these as Base64, so you don't trigger issues by accident. Howeve
by vog 10y ago
I like the idea of providing such a list for testing purposes. I also like the idea of storing these as Base64, so you don't trigger issues by accident.
However, I also imagine how such a list could be misused to actually decrease the security of a system:
Imagine this list is handled the same way as virus signatures in so-called anti-virus software. Instead of properly handling user input, an application would check against this list and call itself "secure". Maybe with with partial and/or fuzzy comparison. If you demonstrate that this approach is deeply flawed by showing another unsafe input, they'd simply add that to the list and call themselves "secured" against this attack.
- tomascot 10y agoIf someone uses this list for security purposes I think that someone has a bigger problem.
- beefield 10y agoCan you elaborate? What other uses this list could have than security purposes?
- kedean 10y agoIt should not be used for security purposes when security purposes is defined as components that maintain the security at runtime. It is valuable as a testing tool, but only against a completely finished system.
- kedean 10y agoIt should not be used for security purposes when security purposes is defined as components that maintain the security at runtime. It is valuable as a testing tool, but only against a completely finished system.
- Taek 10y agoSuch an application is not likely to be secure in the first place. If you've gotten as far as trying this list, you're probably well above the median.
- minimaxir 10y agoThis is a fair concern. Added a comment to the disclaimer: https://github.com/minimaxir/big-list-of-naughty-strings/commit/b9b1f3e4873f06bf9ad1fdb72852a04be854d89f https://github.com/minimaxir/big-list-of-naughty-strings/com...
- nsgi 10y agoIt could conceivably be used as a second-line defence, similar to content security policy. This may be a bad idea depending on how it is implemented and whether the system is tested with it turned off.