3 ms·
Or, e.g. my preferred encoding of HTML: (html "abc") This guarantees that no matter what is inside "abc" it simply can't escape into the control stream:
by eadmund 9y ago
Or, e.g. my preferred encoding of HTML:
(html "abc")
This guarantees that no matter what is inside "abc" it simply can't escape into the control stream:
(html "This is not (malicious \"boo\")")
This is just a pretty display of what would actually be these bytes:
(4:html29:This is not (malicious "boo"))
It doesn't matter what one puts in the atom: it can't escape and damage the control stream.
- aidenn0 9y agoThe two are very different: (html "user content") user content := " (script "something malicious")" (html "" (script "something malicious")) the length-prefixed version cannot escape in this way.