4 ms·

Parse don't sanitize

• XorNot 5y ago
  Except parsing is usually a pretty good way to wind up with an exploit in the first place. You need to do both.
  • TeMPOraL 5y ago
    Not if you're actually parsing, with an explicit parse step and a well-defined language. Exploits tend to happen when parsing is done by the so-called "shotgun parser" - aka. various checks and conditionals randomly scattered throughout your code, that implicitly define an input language that's different from what you think it is.