4 ms·
Sounds reasonable only if the text is a URI handler format; http:// http:// file:// ftp:// steam:// etc. But then what about almost-uri text. www.yourbank.com
by syn0byte 7y ago
Sounds reasonable only if the text is a URI handler format; http:// http:// file:// ftp:// steam:// etc.
But then what about almost-uri text. www.yourbank.com without the https:// https://. Or lookalikes "https:\\" or... what about proxies? does https://l33th4x.com?proxy=www.bank.com https://l33th4x.com?proxy=www.bank.com count if the text is www.bank.com?
Filtering crap like this sounds reasonable but very quickly becomes an exercise in what I call "Giving a mouse a cookie." Now you have a huge complex chunk of code to parse and filter URLs/URIs and every look-alike you can think of; Did you remember that automatic deserialization that kicked in when your values were sent to a callback?
2 days of work later, your new build has fancy-pants a tag filtering that contains and unknown number of bugs and phishers just register and use new domains that look kinda legit and follow your new text/link rules. www.security-wellsfargo-audit.com/login looks legit to the mark, your mail client allowed it so it must be OK.
- appleflaxen 7y agouh... ok... I'll bite... why do you call it "giving a mouse a cookie"
- the_jeremy 7y agoLet me google that for you: https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie
- jamescostian 7y agoSee https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie "If you give a mouse a cookie, he'll ask for a glass of milk" "If you give a mouse a glass of milk, he'll ask for a straw" And the story keeps going like that, with more and more requests coming in. It's almost like never-ending scope creep, except the book has an infinite loop in it.
- duxup 7y agoThere's also an animated series on Amazon now... my youngest loves it.
- smallbigfish 7y agoThat filtering code should already be there in web app.
- Goronmon 7y agoFiltering crap like this sounds reasonable but very quickly becomes an exercise in what I call "Giving a mouse a cookie." Now you have a huge complex chunk of code to parse and filter URLs/URIs and every look-alike you can think of; Did you remember that automatic deserialization that kicked in when your values were sent to a callback? This sounds an awful lot like how software development in general works... Isn't all software just some version of "Giving a mouse a cookie."?