4 ms·
Well we are discussing it now with no issue, so clearly the browser could (or could have, probably too late now) picked a sensible default
by mhh__ 5y ago
Well we are discussing it now with no issue, so clearly the browser could (or could have, probably too late now) picked a sensible default
- avian 5y agoImagine Stack Overflow, but without code snippets. Sounds more like an idea for an art project. It would probably read like early texts on mathematics before modern notation was invented, where it's all just textual descriptions on how to solve various problems.
- deleted 5y ago[deleted]
- gowld 5y agoThat's another way of saying "all code input must be escaped" :-)
- deleted 5y ago[deleted]
- mhh__ 5y agoAdding a flag to allow people to write stackoverlow is perfectly reasonable, the default should not allow non-expert programmers to waltz into issues like this.
- shkkmo 5y agoThis isn't "expert" level knowledge. This is a basic principle of any client / server system. In fact, including default client side protections would not have fixed this issue (since this issue involved bypassing client side protection.)
- jameshart 5y agoThe sensible default is to allow arbitrary text input and pass it on correctly encoded to the next system. Which is what browsers do.
- chmod775 5y agoBrowsers aren't doing anything differently because the people who write browsers happen to understand the threat model. You can sanitize input fields on the client all you want and an attacker would still send whatever the hell they felt like to the server.
- sgerenser 5y agoTrying to sanitize on the input side reminds me of Cisco’s fix for a vulnerability in their routers that involved disallowing requests with a user agent containing “cURL”.