3 ms·

It's interesting how so much of programming is knowing about the existence of libraries and not trying to rebuild things that already exist. I'm sure there are

by vxNsr 7y ago

It's interesting how so much of programming is knowing about the existence of libraries and not trying to rebuild things that already exist. I'm sure there are thousands of people out there who sanitize inputs and outputs naively and don't know about great libs like DomPurify. I know I'm guilty of trying to build something from first principles only to google it after banging my head against edge cases and finding a ready-made library or util that with a tiny bit of finesse or modification does the job.

CiPHPerCoder 7y ago
> I'm sure there are thousands of people out there who sanitize inputs and outputs naively and don't know about great libs like DomPurify. Also HTMLPurifier for PHP, and probably several others in other languages.
inapis 7y ago
TBF, most of these libraries are not easily discovered. You have to luck on the chance that the library author used similar words as your search query. Barring major stuff (authentication, databases etc), you will rarely know about a library in existence. Search engines are still limited by the language of humans. Unless and until, you note down every possible library you come across for future reference, this problem is here to stay. Maybe a language having a vast standard library won’t suffer from this problem but it will definitely have other problems.
- vxNsr 7y ago
  yeah, creating a personal search db is time consuming and kinda impossible... a while ago everyone was coming up with bookmark managers that kinda sorta could function as a personal search db, but it still required a lot of customization. Also they were all cloud based, and didn't really function offline.
simonw 7y ago
One of the most useful skills I've developed over the years is a very strong instinct for "someone else will have solved this already in an open source library", combined with intuition on exactly how they would have described it so I can find it with search.
SahAssar 7y ago
DomPurify by default allows style tags ( https://github.com/cure53/DOMPurify/blob/master/src/tags.js#L99 https://github.com/cure53/DOMPurify/blob/master/src/tags.js#... ) which can be used for tracking visits and some types of password extraction from certain types of frameworks (see https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense https://www.mike-gualtieri.com/posts/stealing-data-with-css-... and https://github.com/maxchehab/CSS-Keylogging https://github.com/maxchehab/CSS-Keylogging ). Also regarding these types of mitigations see https://www.youtube.com/watch?v=lG7U3fuNw3A https://www.youtube.com/watch?v=lG7U3fuNw3A which explains how some good mitigations might not catch all edge cases. I don't think there is a golden rule for this stuff besides having a very strict CSP that only allows same-site resources and no eval/inline with reporting to see when someone has tried to do something bad.

by vxNsr 7y ago

CiPHPerCoder 7y ago

> I'm sure there are thousands of people out there who sanitize inputs and outputs naively and don't know about great libs like DomPurify. Also HTMLPurifier for PHP, and probably several others in other languages.

inapis 7y ago

TBF, most of these libraries are not easily discovered. You have to luck on the chance that the library author used similar words as your search query. Barring major stuff (authentication, databases etc), you will rarely know about a library in existence. Search engines are still limited by the language of humans. Unless and until, you note down every possible library you come across for future reference, this problem is here to stay. Maybe a language having a vast standard library won’t suffer from this problem but it will definitely have other problems.

vxNsr 7y ago
yeah, creating a personal search db is time consuming and kinda impossible... a while ago everyone was coming up with bookmark managers that kinda sorta could function as a personal search db, but it still required a lot of customization. Also they were all cloud based, and didn't really function offline.

simonw 7y ago

One of the most useful skills I've developed over the years is a very strong instinct for "someone else will have solved this already in an open source library", combined with intuition on exactly how they would have described it so I can find it with search.

SahAssar 7y ago

DomPurify by default allows style tags ( https://github.com/cure53/DOMPurify/blob/master/src/tags.js#L99 https://github.com/cure53/DOMPurify/blob/master/src/tags.js#... ) which can be used for tracking visits and some types of password extraction from certain types of frameworks (see https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense https://www.mike-gualtieri.com/posts/stealing-data-with-css-... and https://github.com/maxchehab/CSS-Keylogging https://github.com/maxchehab/CSS-Keylogging ). Also regarding these types of mitigations see https://www.youtube.com/watch?v=lG7U3fuNw3A https://www.youtube.com/watch?v=lG7U3fuNw3A which explains how some good mitigations might not catch all edge cases. I don't think there is a golden rule for this stuff besides having a very strict CSP that only allows same-site resources and no eval/inline with reporting to see when someone has tried to do something bad.