3 ms·
What is really bugging me as a programmer: We live in the 21st century and people still include user-supplied data in their pages as if Cross-Site Scripting (XS
by bflesch 15y ago
What is really bugging me as a programmer: We live in the 21st century and people still include user-supplied data in their pages as if Cross-Site Scripting (XSS) is totally unknown.
I get a bad feeling when these simple attacks are possible; because this shows that there are fundamental flaws in some people's coding styles. I know this sounds harsh, and I recognize it is llamdba's weekend project, but these flaws show neglection of fundamentals in handling data.
Apart from this, this live log is very entertaining!
- llambda 15y agoYou're absolutely right, I overlooked the fact that the log data wasn't being escaped (something that I had realized in a previous chat application I had made last week). A quick fix is to use flask's built-in escape function, something like: line = escape(line). The server is now escaping lines off the log.