5 ms·
I'm curious what the vulnerability is? Also not clear what the null character is. Any links I can follow? And again, if this is your line in the sand, how do
by taeric 4y ago
I'm curious what the vulnerability is? Also not clear what the null character is. Any links I can follow?
And again, if this is your line in the sand, how do you serialize NaN and Infinity in JSON?
Edit: Playing with this a bit, I'd actually assume that allowing \0 would be a vulnerability. I was curious how browsers treat it, so I see that parsing to an html document seems to just drop the characters? Fun little rabbit hole to jump in!
- slaymaker1907 4y agoYeah, that's why I consider it to be a breeding ground for vulnerabilities. People will probably just assume the XML serializer can handle any strings in their language of choice and not handle those edge cases. What I ended up doing for my use case was to encode nulls as " " but within a CDATA section so it was interpreted literally (choosing ambiguity over omission). The best way would probably be to have some sort of spell <null /> element, but there isn't such a thing within the standard. There asi:nil, but that is really indicating something else.
- taeric 4y agoBut what is the vulnerability? And what is a null character doing in a text document? If you are just worried about data loss, having null allowed in text segments is already begging for failure, as C programs will almost certainly get them wrong. If you are transferring binary, base64 or similar will already cover you. And again, if this is a strike on xml, how do you represent NaN in a JSON document? Do what DynamoDB does and wrap all numbers in quotes?