2 ms·
It's a lot of handwaving. So Google improperly saved HTML into database string fields and now needs to figure out how to safely render it in a template. We don'
by rubbingalcohol 7y ago
It's a lot of handwaving. So Google improperly saved HTML into database string fields and now needs to figure out how to safely render it in a template. We don't need a new web "standard" to help them wallpaper over their first-party bugs.
For the longest time Firefox add-on developers were prohibited from submitting extensions with eval or innerHTML precisely because it is ~not safe~! Adding a bunch of browser-enforced regex checks to your strings is the wrong solution here. The solution is to not write code that writes itself.
- rictic 7y agoTrusted Types lets you do exactly this! You explicitly list the trusted types policies that you allow on your page, and if none of them declare the createHTML method then there is no way to set innerHTML (even inside some a new version of some obscure dependency of a dependency, or in some script that an intern plopped into the page, or in some five year old code that seemed reasonable at the time that you've totally forgotten about... (not like that happened to me recently))
- jamesgeck0 7y ago> So Google improperly saved HTML into database string fields and now needs to figure out how to safely render it in a template. FWIW, "store anything, sanitize at render time" is the preferred approach for some popular web frameworks, including Rails.
- rubbingalcohol 7y agoAnd that's fine. To the extent that stored data represents a security risk, sanitization can and should be done on the server side.