5 ms·

What is the point of sanitizing input in JavaScript? One could easily bypass that and still put nasty stuff in the input. I think this is a bad idea, I just kn

What is the point of sanitizing input in JavaScript? One could easily bypass that and still put nasty stuff in the input. I think this is a bad idea, I just know there will be people who will make applications that will rely entirely on this API with disastrous results.

asdfaoeu 5y ago
You would sanitize it on the receiving end
- FriedrichN 5y ago
  I didn't think of that. I assumed the backend would already have sanitized it. Either way, I think there should be a warning that it should never be used for input sanitation.
tantalor 5y ago
Explain "easily bypass"?
- FriedrichN 5y ago
  To clarify, I was assuming this was going to be used for input sanitation. If it were used for that a malicious actor could see where a form or XHR call would post to and simply post the raw input to that endpoint, bypassing any sanitation.
  - tantalor 5y ago
    Oh, no it's not meant for that. It's used for sanitizing untrusted outputs for display.
caustic 5y ago
Never sanitize user data before storing it in your backend. Always sanitize user data before displaying it on the screen.
- wccrawford 5y ago
  I would amend that slightly: It's okay, but mostly a waste of time, to sanitize data before storing it. You must sanitize data when outputting it. Why? Because someone could get the data into storage in another way, or new vulnerabilities might be discovered that you aren't sanitizing for before storage.
prussian 5y ago
The only positive I can think of, is you run, say a comment section on a news aggregator. You could let people freely type up their own markup in a <textarea>, accept it as is and just throw it at clients to clean on their own. Another great use I could think of, say you have an image upload service, assuming this would work with SVG as well, you could just serve all sorts of potentially malicious SVG and have the client remove all the script tags. While I'd prefer the inputs stored server-side to be pre-sanitized, I can see the benefit for just not touching it and shrugging.
iVanlIsh 5y ago
IMHO, the idea here is nowadays more and more people are using third-party libraries which is hard to trust and even worse while people `npm update` them with no idea what changed between versions.

asdfaoeu 5y ago

You would sanitize it on the receiving end

FriedrichN 5y ago
I didn't think of that. I assumed the backend would already have sanitized it. Either way, I think there should be a warning that it should never be used for input sanitation.

tantalor 5y ago

Explain "easily bypass"?

FriedrichN 5y ago
To clarify, I was assuming this was going to be used for input sanitation. If it were used for that a malicious actor could see where a form or XHR call would post to and simply post the raw input to that endpoint, bypassing any sanitation.
- tantalor 5y ago
  Oh, no it's not meant for that. It's used for sanitizing untrusted outputs for display.

caustic 5y ago

Never sanitize user data before storing it in your backend. Always sanitize user data before displaying it on the screen.

wccrawford 5y ago
I would amend that slightly: It's okay, but mostly a waste of time, to sanitize data before storing it. You must sanitize data when outputting it. Why? Because someone could get the data into storage in another way, or new vulnerabilities might be discovered that you aren't sanitizing for before storage.

prussian 5y ago

The only positive I can think of, is you run, say a comment section on a news aggregator. You could let people freely type up their own markup in a <textarea>, accept it as is and just throw it at clients to clean on their own. Another great use I could think of, say you have an image upload service, assuming this would work with SVG as well, you could just serve all sorts of potentially malicious SVG and have the client remove all the script tags. While I'd prefer the inputs stored server-side to be pre-sanitized, I can see the benefit for just not touching it and shrugging.

iVanlIsh 5y ago

IMHO, the idea here is nowadays more and more people are using third-party libraries which is hard to trust and even worse while people `npm update` them with no idea what changed between versions.