2 ms·
The problem here is not input, it’s output. Apple’s web backend is spitting out strings without escaping them to HTML, which is a real novice error at this poin
by afavour 5y ago
The problem here is not input, it’s output. Apple’s web backend is spitting out strings without escaping them to HTML, which is a real novice error at this point in the web’s evolution. Sanitising inputs in browsers would be a nightmare of never ending complication.
- still_grokking 5y agoActually you can't "sanitize" inputs as you can't know upfront in which context this data will end up. So the rule is: Never try to "sanitize" inputs, always sanitize outputs respective to output-context. Regarding XSS there is this nice overview: https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Ev... As this is a complicated topic one should never try to escape things "by hand", for example by some "clever" regex. You won't catch this way all the possible encodings!