3 ms·
Yes - this app is not a good example of doing this "right" (my bad). It should instead sanitize the input before displaying it (especially to another user).
by mckoss 16y ago
Yes - this app is not a good example of doing this "right" (my bad). It should instead sanitize the input before displaying it (especially to another user).
- ktsmith 16y agoI wasn't trying to pick on your wiki app, it was just a readily available example where input/output sanitization wasn't happening. I'm not sure what your target demographic is, but I would be surprised if this wasn't a very common problem that your potential users encounter. One of the advantages of many of the server side frameworks is that they provide this type of sanitization for free.
- mckoss 16y agoYeah. In this app I used the (very nice) ShownDown.js as a MarkDown format generator. Which DOES properly sanitize most input. I then added the special <script> evaluation stuff as a cool "hack". As client-side JavaScript gets more mature, I do expect there to be more frameworks that will just "do the right thing" for developers who write code like this.
- ktsmith 16y agoMaybe your app could be the launching point for one of those frameworks as well, it might be a nice value added feature.