3 ms·
Why in the world would I want to collect garbage. Sure I can post process all of the survey data but it's trivial to do it on the front end so why not. In a sig
by ktsmith 16y ago
Why in the world would I want to collect garbage. Sure I can post process all of the survey data but it's trivial to do it on the front end so why not. In a significant number of other cases failing to validate input would simply be a non starter limiting this to toy apps.
As to the second point: Who said anything about _me_ running a javascript eval on user supplied data.
Go look at their wiki example click edit and in the text box type: <script>alert('boo');</script> then click the hide button.
Notice two things. The first is that when you type the last > on the ending script tag the included script executes and you get the alert popup. When you reload the page you'll still see the alert('boo'); in the wiki display (in <code> tags) but the <script> tag is still live in the page as there's either no or very limited output sanitization. In a typical client/server application this is hopefully going to be sanitized or eliminated prior to ever being stored. The storage format is irrelevant if the data being stored is spit right back out into the page as in the wiki example.
- drcode 16y agoYou're absolutely right on the alert issue in the wiki: Displaying unsanitized text in this way is a security bug. However, I think the security bug is in the client app, which should sanitize any data it pulls from the server, if the server data may have originated from another user (if this is even possible in the current pageforest API) not in the inherent design of pageforest. But that is indeed a good argument in your favor, ktsmith.
- mckoss 16y agoYes - this app is not a good example of doing this "right" (my bad). It should instead sanitize the input before displaying it (especially to another user).
- ktsmith 16y agoI wasn't trying to pick on your wiki app, it was just a readily available example where input/output sanitization wasn't happening. I'm not sure what your target demographic is, but I would be surprised if this wasn't a very common problem that your potential users encounter. One of the advantages of many of the server side frameworks is that they provide this type of sanitization for free.
- mckoss 16y agoYeah. In this app I used the (very nice) ShownDown.js as a MarkDown format generator. Which DOES properly sanitize most input. I then added the special <script> evaluation stuff as a cool "hack". As client-side JavaScript gets more mature, I do expect there to be more frameworks that will just "do the right thing" for developers who write code like this.
- ktsmith 16y agoMaybe your app could be the launching point for one of those frameworks as well, it might be a nice value added feature.