3 ms·
Lack of understanding of string escaping. - Trying to remove/escape "bad" characters on input or thinking that only "user" input needs escaping. This means any
by pornel 9y ago
Lack of understanding of string escaping.
- Trying to remove/escape "bad" characters on input or thinking that only "user" input needs escaping. This means anything that slips past the filtering can do unlimited damage. Any "special" characters get lost or mangled in uncontrollable ways. The right way is to escape data on output.
- Thinking "escaping" is one universal thing that can be done in advance. This leads to HTML-escaped text in email subjects, SQL-escaped strings in HTML, etc.
- Forgetting that nested contexts require multiple levels of escaping (e.g. an URL argument in string in JS in an HTML script tag requires URL-escaping followed by JS string escaping followed by HTML-script escaping).
- Voodoo escaping such as `sprintf(buf, "cmd '%s'", arg)`
- Something1234 9y agoCan you expand on escaping on output?
- pornel 9y agoEscaping depends on the context where the string is used, and the same string may be used in many different contexts. For example, you might need to insert someone's name in HTML, JSON, SQL, and e-mail headers/body. Each of these has different escaping syntax, so you can't reliably escape/sanitize the name ahead of time (if you try, people named O'Connor will hate you), so it's best to apply appropriate flavor of escaping as late as possible (e.g. your HTML template engine should apply HTML-escaping, your e-mail library should apply quoted-printable, etc.) Escaping on output also makes text processing easier and more reliable. For example, if you cut a string, you don't have to worry you'll cut it in a middle of an HTML entity or just after a backslash.