3 ms·
Frameworks like Django and Ruby on Rails 3 do a good job of HTML-escaping everything that goes out. It's better to escape _everything_ by default and let the pr
by kennu 16y ago
Frameworks like Django and Ruby on Rails 3 do a good job of HTML-escaping everything that goes out. It's better to escape _everything_ by default and let the programmer explicitly say if something should not be escaped.
I guess GitHub is using Rails 2, which doesn't escape output by default.
- drdaeman 16y agoPerl has awesome feature called "taint mode", where data derived from outside of the program may not be used to affect something else outside of the program. Every variable has a "taint flag", and it's a programmer's job to "launder" the data. Any attempt to use tainted data except for use in specifically permitted cases (like in print or syswrite calls) will result in a error. Concatenating tainted string with untainted one will result in a new tainted string. Django has similar, albeit somehow weaker concept with SafeString. Unfortunately, I'm not familiar with Ruby/Rails. However, consider outputting data as JSON for some fancy AJAX client-side stuff. While I doubt someone will forget to properly escape JSON, forgetting to escape strings as HTML is fairly easy, and no taint checks would prevent you from doing this.
- d1b 16y agothis isn't going to fix anything that wouldn't be fixed via ensuring that stuff is escaped already on the page...