3 ms·
The worst part is that someone assumed something then removed the code that did the escaping without even doing the most basic of tests, like even in the browse
by ddtaylor 8y ago
The worst part is that someone assumed something then removed the code that did the escaping without even doing the most basic of tests, like even in the browser just doing a quick foo.html('<script>alert("oh snap this is bad")</script>')
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- icebraining 8y agoMaybe he did and it didn't work for some reason and he thought it was good. Shit happens. I think the most worrying part is not having been caught in code review. Signal does code review, right?
- Cakez0r 8y agoEven worse than that, it looks like there _were_ unit tests to check that input was correctly sanitized, but the patch that introduced the bug also explicitly changed the unit tests to ensure that input was _not_ being escaped! A mistake that seems like it could've been caught in a code review!
- ddtaylor 8y agoThese are the kinds of things that make tinfoil hats wonder if any agencies interested in subverting encryption "plant" employees. It's difficult to differentiate stupidity from malice. We know they use shell companies and subvert device manufacturers and standards, so it's not unfathomable.