6 ms·
The Grave Accent and XSS
- andybak 9y agoWasn't adding a new character to browsers that needs escaping a grave (heh) error of judgement? There's a lot of unmaintained client side code out there.
- TazeTSchnitzel 9y agoEscaping <>"' properly is still enough. Without them you can't create the <script> needed to use a backtick.
- extrapickles 9y agoYou need to escape =. Otherwise if someone does something like: document.write("<a class=" + str + " href='foo'>xss</a>"); The attacker can set str to "foo onclick=alert(1)".
- jwilk 9y agoYou should put quotes around the attribute value. Then you won't need to escape =.
- extrapickles 9y agoThe issue is when a developer forgets to do so. No reason to not escape it.
- TazeTSchnitzel 9y agoYou can't safely put arbitrary user input in an unquoted attribute value.
- chrismorgan 9y agoRemember & as well. Inside an attribute value: use single or double quotes, then escape ampersand (&) and the other type of quote (" or '). In a text value: all you need to escape are less than (<) and ampersand (&). In any other location: … why are you doing this? (<>"'& is enough to cover everything, but you probably shouldn’t be doing this in the first place.)
- deleted 9y ago[deleted]
- limeblack 9y agoOn the topic of XSS it seems funny that https makes you think something is secure when it is often not with XSS. I remember finding an XSS in our high school system. Even though the page was https the XSS allowed you to embed other https sites which let me do malicious things without anyone knowing.
- lucb1e 9y agoAssuming a website is secure only because it has a padlock, is like assuming a room is secure because it has a padlock. The room might have windows, back doors, or the hinges might be on the outside. Https (reasonably) guarantees confidentiality and integrity of the connection to the server, nothing more and nothing less.
- limeblack 9y agoThat is fair point but I think there should be an option to only enable certain sites as whitelisted sort of like robots file. That would mostly solve the issue.
- jakobdabo 9y agoContent Security Policy - https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
- throwaway613834 9y ago> Https (reasonably) guarantees confidentiality and integrity of the connection to the server, nothing more and nothing less. Nah, this is pretty wrong. It would be pretty useless (if not dangerous) if that were all it did. The most important thing it establishes is the server's authenticity, i.e. you don't want a tamper-proof and confidential connecting with the wrong server! And moreover, once you can guarantee authenticity, the rest are secondary since they're easy to subsequently establish via key exchange and hashing.
- 9y ago
- 131hn 9y agoI do not think this symbol is nor used (in addition with a letter), nor ever called anything but "backtick". it's not an "accent grave" (even if it might be used as it), but a revert appstrophe - backtick or backquote.
- Symbiote 9y agoThe key marked ` is often set as a "dead key" on European keyboard layouts -- typically the layouts where the accent isn't commonly used, but will be needed for typing people and place names, or the occasional foreign word. With a Danish Mac layout, to type ` I press it then press space. To type è, ì etc, I press `, then press the vowel. Similarly I can use the keys marked ¨ ^ and ´. (The Danish letters æ, ø, å have their own keys, since they are used very frequently.) So, I would never call it "backtick", since it is a grave accent.
- Zecc 9y agoIt pisses me off to no end when software uses keyboard shortcuts like Ctrl+` or even just ~. These are simply unusable with my keyboard.
- kps 9y agoIt pisses me off to no end when software uses keyboard shortcuts like Ctrl+anything, unless it's using ASCII control characters (e.g. vi, emacs). Every *nix GUI toolkit knew this until the year-of-desktop-Linux crowd insisted on slavishly imitating every Windows mistake.
- deleted 9y ago[deleted]
- glitch 9y agoIt is a grave accent. Something which was and still largely is of little use to many that grew up in United States knowing only English. So, such users abused and re-purposed it as a "backtick", which feels like an unfortunate decay due to ignorance. But such things continually happen.