4 ms·
Question- if you're using eval() and bleach, won't your security be totally dependent on bleach not having a vulnerability?
by jgalentine007 5y ago
Question- if you're using eval() and bleach, won't your security be totally dependent on bleach not having a vulnerability?
- RNCTX 5y agoSure. Kinda like how storing web templates in files is totally dependent on the people who upload them not putting crypto miners in the linked javascript(s) [1]. Or totally dependent on PAM not having a vulnerability [2]. Or totally dependent on SSH not having a vulnerability [3]. In terms of libraries and utilities I can give PAM and SSH a pass for fixing these things long ago. In the case of restricting a customer's access to the mechanism that renders their thing in favor of the option of "trust this guy who uploads things instead" you've got a much tougher sell about why that's better. 1. https://www.fortinet.com/blog/threat-research/the-growing-trend-of-coin-miner-javascript-infection https://www.fortinet.com/blog/threat-research/the-growing-tr... 2. https://www.cvedetails.com/cve/CVE-2002-1227/ https://www.cvedetails.com/cve/CVE-2002-1227/ 3. https://www.cvedetails.com/cve/CVE-2002-0083/ https://www.cvedetails.com/cve/CVE-2002-0083/