4 ms·

Perhaps the response should not return raw HTML: # curl https://simplekv.com/path/to/key2 https://simplekv.com/path/to/key2 <html><body><h1>Well, this seems s

Perhaps the response should not return raw HTML: # curl https://simplekv.com/path/to/key2 https://simplekv.com/path/to/key2 <html><body><h1>Well, this seems safe...</h1></body></html>

re6tor 5y ago
Thanks for your feedback! I see input sanitation as a double-edged sword: it could potentially prevent some misuse of the service (since it's 100% anonymous), but then ultimately you're the "owner" of your keys (though they're in reality public) and you should be able to write whatever you want in them. I guess this argument could also be applied to Pastebin? Should it be returning raw HTML if asked to?
- fathyb 5y ago
  The "Content-Type" HTTP header is "text/html; charset=utf-8", you could make it "text/plain; charset=utf-8" to prevent HTML from being parsed.
  - re6tor 5y ago
    That makes total sense, cheers!