3 ms·
Holy hell, OP. What prevents me from just calling "postMessage" directly myself, which does nothing to prevent the "sanitation" that the replace function call
by llarsson 6y ago
Holy hell, OP.
What prevents me from just calling "postMessage" directly myself, which does nothing to prevent the "sanitation" that the replace function call there is supposed to do?
Please sanitize messages on the server instead.
- Mapsmithy 6y agoThe fact that it's also called when its added to the stack for display. OP should definitely still sanitize on the server, but it's not as bad as it sounds at first glance. As an exercise I'd love it someone actually posted a payload to exploit that regex.