3 ms·

Because of things like mass assignment or IDOR, or injection attacks, presumably. Handing data from the user (untrusted input) directly to the backend unchange

Because of things like mass assignment or IDOR, or injection attacks, presumably. Handing data from the user (untrusted input) directly to the backend unchanged is going to in 99.9999999% of cases also mean it's unchecked. "I'm not smart enough to bother sanitizing my input, or to learn about stuff that's someone else's job like security" would fit right into this "manifesto".

nerdchum 3y ago
Sanitizing data is string based not data structure based though.
- ang_cire 3y ago
  Well first off, that's not correct anyways; type-conformancy is a very valid and important part of data sanitization. E.g. does the SSN consist of 3 valid integers split on dashes? If not, it ain't a proper SSN. Catching that typeError is much safer than trying to roll regex or character allow/blocklists. But also, the manifesto never mentions data structures. It says > I’m not smart enough to figure out how to transform data between different layers of the system, so I just don’t. I use the same represetnation in the UI layer and the storage layer. Transforming data means actually changing the data, not the data structure that houses it. The author is explicitly talking about making changes to the data itself.
  - nerdchum 3y ago
    You shouldnt have to "transform" the data though. You should validate the data and sanitize the data...but if youre transforming data youre headed into a state management nightmare. State management is the number one enemy and other than sanitizing and validating both the data and structure should be considered mostly immutable.
    - ang_cire 3y ago
      You absolutely may need and want to transform data. You don't want to store code unmodified in a database; that's how you end up with SSTI or stored XSS. You encode special characters in a simple, reversible way (as one example). Similarly, you don't store passwords untransformed in a db, you hash them. That's a transform. There are tons of examples like this.
Solvency 3y ago
You're taking about securing the data itself, which has nothing to do with its parent structure.
- ang_cire 3y ago
  And in the manifesto the author says > I’m not smart enough to figure out how to transform data between different layers of the system, so I just don’t. I use the same represetnation in the UI layer and the storage layer. That has nothing to do with the data structure, is about how the data is being represented in the backend vs the frontend. It's explicitly about changing the data itself. Stuff like url-encoding and escaping characters are examples of transforming data to be represented differently in the backend (where e.g. it's encoded or escaped) from the frontend (where it's displayed in "proper" formatting).
  - nerdchum 3y ago
    Yeah, other than sanitizing and validating, you shouldn't be transforming data or you're headed into a state management bug nightmare.
    - ang_cire 3y ago
      So you think that if e.g. Stack exchange is storing code examples in their database, they shouldn't transform the special characters into e.g. url-encoding or some other escaped format? How are you going to validate it doesn't do something harmful? And also, you keep mentioning sanitization as though it's not inherently a transform. Stripping out whitespace? That's a transform. Just because it's a one-directional transform doesn't make it not one.

nerdchum 3y ago

Sanitizing data is string based not data structure based though.

ang_cire 3y ago
Well first off, that's not correct anyways; type-conformancy is a very valid and important part of data sanitization. E.g. does the SSN consist of 3 valid integers split on dashes? If not, it ain't a proper SSN. Catching that typeError is much safer than trying to roll regex or character allow/blocklists. But also, the manifesto never mentions data structures. It says > I’m not smart enough to figure out how to transform data between different layers of the system, so I just don’t. I use the same represetnation in the UI layer and the storage layer. Transforming data means actually changing the data, not the data structure that houses it. The author is explicitly talking about making changes to the data itself.
- nerdchum 3y ago
  You shouldnt have to "transform" the data though. You should validate the data and sanitize the data...but if youre transforming data youre headed into a state management nightmare. State management is the number one enemy and other than sanitizing and validating both the data and structure should be considered mostly immutable.
  - ang_cire 3y ago
    You absolutely may need and want to transform data. You don't want to store code unmodified in a database; that's how you end up with SSTI or stored XSS. You encode special characters in a simple, reversible way (as one example). Similarly, you don't store passwords untransformed in a db, you hash them. That's a transform. There are tons of examples like this.

Solvency 3y ago

You're taking about securing the data itself, which has nothing to do with its parent structure.

ang_cire 3y ago
And in the manifesto the author says > I’m not smart enough to figure out how to transform data between different layers of the system, so I just don’t. I use the same represetnation in the UI layer and the storage layer. That has nothing to do with the data structure, is about how the data is being represented in the backend vs the frontend. It's explicitly about changing the data itself. Stuff like url-encoding and escaping characters are examples of transforming data to be represented differently in the backend (where e.g. it's encoded or escaped) from the frontend (where it's displayed in "proper" formatting).
- nerdchum 3y ago
  Yeah, other than sanitizing and validating, you shouldn't be transforming data or you're headed into a state management bug nightmare.
  - ang_cire 3y ago
    So you think that if e.g. Stack exchange is storing code examples in their database, they shouldn't transform the special characters into e.g. url-encoding or some other escaped format? How are you going to validate it doesn't do something harmful? And also, you keep mentioning sanitization as though it's not inherently a transform. Stripping out whitespace? That's a transform. Just because it's a one-directional transform doesn't make it not one.