3 ms·
It is escaped server side. Anything long enough to be a useful payload is trimmed.
by mike_d 3y ago
It is escaped server side. Anything long enough to be a useful payload is trimmed.
- koolba 3y agoHow short we talking? Since there's multiple opportunities to inject code, it's possible to split out the payload across multiple fields: https://www.highseverity.com/2011/06/xss-in-confined-spaces.html https://www.highseverity.com/2011/06/xss-in-confined-spaces.... Ten characters per block is enough for: <script>/* */eval(/* */'....'+/* */'....'+/* */'....'+/* ... */)/* */</script> Best to escape everything at render time.
- mike_d 3y agoEverything is escaped server side before it is sent to the client. Shoot me an email and I will let you play with it after the HN traffic dies down.
- jamesnorden 3y ago[dead]
- mike_hock 3y agoAs the other comment said, just write proper code instead of going "oh but it's escaped and size-limited." JS has sane APIs where no string is "dangerous," use them.