3 ms·

I'm always curious as to why such an obvious bug couldn't be detected automatically. Some piece of code is printing a user name without sanitizing it. Fixing th

• ma2rten 15y ago
  That is a good question, but I guess the answer is that XSS bugs are particularly hard to catch. Static code analysis can't know if a particular field you use in your templates (or wherever it is that your html gets rendered) is user supplied or not. You can try to catch it using manual code reviews, explicitly marking code that should not be escaped, etc., but it's easy to loose track of it. You also try and have a number of users with names like this in your testing environment, but is not fail-save either.
• btilly 15y ago
  http://en.wikipedia.org/wiki/Taint_checking http://en.wikipedia.org/wiki/Taint_checking provides a way to catch this type of bug. But it is not implemented in most languages. You could also do clever things with type systems in a language with sufficiently complex type checking, but nobody seems to do that either. Unfortunately our industry rewards getting stuff done, and not getting stuff done right. (PHP being an extreme example.) So this state of affairs is likely to remain.