38 ms·
> Punchline: GitHub accepts arbitrary user input and spits it back out into page HTML without verifying it. Because of a bug related to parsing integers, the b
by drewbug01 6y ago
> Punchline: GitHub accepts arbitrary user input and spits it back out into page HTML without verifying it.
Because of a bug related to parsing integers, the behavior you described can happen in the GitHub pages code. However, it is a far cry from "GitHub accepts arbitrary user input and spits it back out into page HTML without verifying it". That's an exceedingly antagonistic way of putting it - and smacks of "I want to make GitHub look dumb by misstating the problem."
- alisonkisk 6y ago> bug related to parsing integers, Right, that's not verifying the result. "alert()" is pretty far cry from an "integer"! How do you even create an "integer" this bad?