25 ms·
A Norwegian social site back in the days called Nettby ("net-city") also allowed some html, but did it by just removing unallowed tags. I realised I could write
by maaaats 9y ago
A Norwegian social site back in the days called Nettby ("net-city") also allowed some html, but did it by just removing unallowed tags. I realised I could write <scr<script>ipt>, and after it did the removal of the first script tag I still had one.
This trick still works on surprisingly many sites. Allowing custom html is hard, so think long before rolling your own.
- bsamuels 9y agoa good content security policy goes a very long way towards allowing workable custom html
- gboudrias 9y agoHonestly if it's comments, just use Markdown or something. No reason for your users to have access to HTML.
- TheDong 9y agoYou might not realise it, but the average markdown spec allows embedding html as well.
- joepie91_ 9y agoAnd then this happens: https://github.com/ChALkeR/notes/blob/master/Improper-markup-sanitization.md https://github.com/ChALkeR/notes/blob/master/Improper-markup...
- maxvu 9y agoI think it's funny that JIRA knows how to prioritize the best of all the list.
- joepie91_ 9y agoI'm hoping that was sarcasm...?
- Chickenosaurus 9y agoThis was a fantastic read. For anyone else wondering: "TBA" is an abbreviation for "to be announced".
- ClassyJacket 9y agoWhen you find a site that does this, throw up their login box and the user is looking at a seemingly legit login box genuine hosted by the target site, security certificate and all!
- vidarh 9y agoAnd if you are going to roll your own, whitelist, don't blacklist. And not just tags, but attributes, CSS rules etc., as well as text content (including escaping) Of course, doing that will quickly tell you why you'd probably want to not roll your own... I have rolled my own, twice, back in the day (once for the webmail service Nameplanet which started life in Oslo), and it was an ongoing pain of having to argue with people over why X or Y was filtered out because they didn't realise how it could be abused. I really don't want to ever do that again.
- ungzd 9y agoOnce in 2008-2009 I accidentally found CSRF on vkontakte.ru (now vk.com, now it's very popular social network). I created post on Livejournal with image that loaded from my server, responding with redirect to CSRF URL that posted random phrase from logged in user to single discussion thread. It looked like hundreds of people doing dadaist discussion.