5 ms·

but, what's the actual issue? XSS? what's the vector attack here? where the `text` comes from?

jaffathecake 5y ago
Text like "I'd like to meet you one day & murder you very horribly with a rather large sword" will pass sentiment analysis because everything after the "&" will bypass the check.
- tester34 5y ago
  but is this security issue?
  - jaffathecake 5y ago
    Being able to bypass a check sounds like a security issue to me.
    - tester34 5y ago
      but wouldn't it be the problem with deserialization on the server side? edit. oh I see, somebody can overwrite other params, yea?
      - jaffathecake 5y ago
        It could be client side, where you're using it to hide content from someone who doesn't want to see something potentially abusive. I did assume the example was client side, but it might not be. The server may be using it to avoid adding a comment to a database if it's abusive. URLSearchParams exists in Node too https://nodejs.org/api/url.html#url_class_urlsearchparams https://nodejs.org/api/url.html#url_class_urlsearchparams. There are fetch polyfills available, but the plan is to add it to node.
    - rattlesnakedave 5y ago
      isn't this something that's being executed client side? why trust it at all?
- rendall 5y ago
  This is why you clean data on the server side. It will only "bypass" anything if the backend developer was asleep.
eugenekolo 5y ago
I don't think the author does a good job explaining the security problem, but I believe what they meant is something similar to: text="foo&sendPasswordTo=hacker" or text="foo&admin=1" You can imagine a potentially dangerous parameter and value being passed.
- zild3d 5y ago
  This still seems like a server issue regardless? Using URLSearchParams doesn't mean your server wont see a request with `&sendPasswordTo=hacker`. Sure its nicer on the client side but it doesn't solve the security issue
rendall 5y ago
There is no security issue here. The security check must be done on the server side. That's it. This article is wrong on the internet. People can already send whatever body they want to your API endpoint. Your client side cleaning won't matter

Text like "I'd like to meet you one day & murder you very horribly with a rather large sword" will pass sentiment analysis because everything after the "&" will bypass the check.

tester34 5y ago
but is this security issue?
- jaffathecake 5y ago
  Being able to bypass a check sounds like a security issue to me.
  - tester34 5y ago
    but wouldn't it be the problem with deserialization on the server side? edit. oh I see, somebody can overwrite other params, yea?
    - jaffathecake 5y ago
      It could be client side, where you're using it to hide content from someone who doesn't want to see something potentially abusive. I did assume the example was client side, but it might not be. The server may be using it to avoid adding a comment to a database if it's abusive. URLSearchParams exists in Node too https://nodejs.org/api/url.html#url_class_urlsearchparams https://nodejs.org/api/url.html#url_class_urlsearchparams. There are fetch polyfills available, but the plan is to add it to node.
  - rattlesnakedave 5y ago
    isn't this something that's being executed client side? why trust it at all?
rendall 5y ago
This is why you clean data on the server side. It will only "bypass" anything if the backend developer was asleep.

eugenekolo 5y ago

I don't think the author does a good job explaining the security problem, but I believe what they meant is something similar to: text="foo&sendPasswordTo=hacker" or text="foo&admin=1" You can imagine a potentially dangerous parameter and value being passed.

zild3d 5y ago
This still seems like a server issue regardless? Using URLSearchParams doesn't mean your server wont see a request with `&sendPasswordTo=hacker`. Sure its nicer on the client side but it doesn't solve the security issue

rendall 5y ago

There is no security issue here. The security check must be done on the server side. That's it. This article is wrong on the internet. People can already send whatever body they want to your API endpoint. Your client side cleaning won't matter