5 ms·
The point of all this is that you can safely run untrusted javascript code on your site and not have someone malicious wreak havok. Now there is a way to allow
by p4lindromica 15y ago
The point of all this is that you can safely run untrusted javascript code on your site and not have someone malicious wreak havok.
Now there is a way to allow users to actually supply you with html markup and not have to do anything special filtering-wise on your backend.
see: http://pdos.csail.mit.edu/6.858/2011/labs/lab6.html http://pdos.csail.mit.edu/6.858/2011/labs/lab6.html
- wamatt 15y agoAnd what is the point of that? Can't see much practical use of this. Would love to be enlightened though. It does sound interesting.
- eagsalazar 15y agoUn-trusted 3rd party plugins for your site
- beagle3 15y agoThus replacing vulnerabilities in your HTML sanitizer with vulnerabilities in an emscriptened spidermonkey, which you believe to be safer mostly because you are unable to do a reasonable code review of the resulting code :)
- bluesnowmonkey 15y agoThat's not exactly correct. You still have to trust that the third-party code is extremely performant.