5 ms·
Heh. I once had a security warning from a static analysis tool that did not like my use of `xhr.open("GET")`, flagging it as a security risk. I worked around i
by acemarke 6y ago
Heh. I once had a security warning from a static analysis tool that did not like my use of `xhr.open("GET")`, flagging it as a security risk.
I worked around it with:
var method = ["T", "E", "G"];
method.reverse();
xhr.open(method.join())
still not sure whether to be proud or disgusted with that trick :)
- edoceo 6y agoYou should be proud of how you came up with such a disgusting solution :). Rule #1: if it's stupid and it works, it's not stupid.
- foota 6y agoWhy was that flagged as a security risk?
- faeyanpiraat 6y agoIt might have been software managing sensitive information, and you can leak data that way
- himinlomax 6y agoIt allows xhr.open, just not with a string literal, so that's not the issue.
- acemarke 6y agoHonestly, I can't remember at this point. It had something to do with the use of AJAX overall, and a GET request via XHR specifically, but this was many years ago and I don't know what the specific finding description was.
- giantDinosaur 6y agoA good introduction as to why blacklisting is often a poor approach to dealing with arbitrary input.