3 ms·
Am I missing something or does the quickstart recommend an XSS vulnerability? String name = request.startLine().queryString().get("name"); return Respo
by kevincox 3y ago
Am I missing something or does the quickstart recommend an XSS vulnerability?
String name = request.startLine().queryString().get("name");
return Response.htmlOk(String.format("<p>Hi there %s!</p>", name));
Maybe having a little bit more available would be valuable.
- 7ep 3y agohere’s a more realistic example: https://github.com/byronka/minum_usage_example_mvn/blob/d649af5aae5087a3b23901fc6e5c2b3dc80df204/src/main/java/com/renomad/sampledomain/SampleDomain.java#L36 https://github.com/byronka/minum_usage_example_mvn/blob/d649...
- kevincox 3y agoLooks like that should be the example rather than promoting unsafe coding.
- ptx 3y agoMaking the user manually escape parameters (and be very careful not to miss any) seems at odds with the goals of ease of use and maintainability. Most template libraries do this automatically by default.
- 7ep 3y agoYou are not wrong. Just, here, priority is 1. minimalism 2. ease of use It's an uneasy balance. I am well aware of the value of fully-powered templating engines.
- schemescape 3y agoFor the record, I love this project's minimalist goal. Having said that, I agree with the other commenter that escaping by default (with an opt-out mechanism) is probably the better choice. I don't even think this violates your prioritization because it should result in less code when considering an app in its entirety (framework + logic).
- 7ep 3y agoInteresting point. Definitely worth considering. Thanks.
- deleted 3y ago[deleted]
- paulddraper 3y agoAh but its "minimal". Taking the web back to its roots.