4 ms·
To clarify, I was assuming this was going to be used for input sanitation. If it were used for that a malicious actor could see where a form or XHR call would p
by FriedrichN 5y ago
To clarify, I was assuming this was going to be used for input sanitation. If it were used for that a malicious actor could see where a form or XHR call would post to and simply post the raw input to that endpoint, bypassing any sanitation.
- tantalor 5y agoOh, no it's not meant for that. It's used for sanitizing untrusted outputs for display.