3 ms·

I know that an unsanitized HTML input is a stupid issue to begin with, but update issued within 24 hours of discovery (and within 5 hours from disclosure)? That

• masklinn 8y ago
  > I know that an unsanitized HTML input is a stupid issue to begin with Input is never the issue, output is: you don't know how the input will be used/rendered, so it should be messed with as little as possible.
  • eximius 8y ago
    Depends entirely on your application. Often you know, or are willing to constrain, the uses of an input.
    • Bartweiss 8y ago
      And for encryption, absolutely should when in doubt. The HTML tag attack on PGP works by mixing plain and cipher text, which is a thing people might genuinely want to do. But the safer clients still interfered with it by re-encrypting anything which didn't begin with a PGP signature, for the very good reason that they couldn't trust mixed messages. The clients which mildly constrained inputs prevented the entire attack vector, and it looks a very good tradeoff right now.