3 ms·
>If a user wants their title to be “hello%0a%3C%25%3D%20File.open%28%27flag.txt%27%29.read%20%25%3E”, so be it. that's a good way to horizontally propagate/ref
by Jerrrry 2y ago
>If a user wants their title to be “hello%0a%3C%25%3D%20File.open%28%27flag.txt%27%29.read%20%25%3E”, so be it.
that's a good way to horizontally propagate/reflect XSS and other Code As Data vulnerabilities.
better to strip the known-bad/problematic characters
https://en.wikipedia.org/wiki/Code_as_data https://en.wikipedia.org/wiki/Code_as_data
- ec109685 2y agoThe known problematic characters are different in json, xml, css, html content, html attributes, MySQL, etc. Unless you have output escaping, it is hard to ensure everything gets caught, no matter how the data enters the system.
- tsimionescu 2y agoSure, but there is a common set of safe characters that are guaranteed not to cause problems in any of these: the set described by the regex [a-zA-Z0-9 -]. If you can limit user input to this set, you'll drastically reduce the risk of code injection regardless of the stack below you.
- phyzome 2y agoAnd that's how you end up pissing off users with apostrophes in their names.
- Terr_ 2y ago"Alright. If you’re gonna go ahead with it, I want to make sure you get one thing right. It’s “O’Neill,” with two L’s. There is another Colonel O’Neil with only one L and he has no sense of humor at all."
- Jerrrry 2y agoone apostrophe? sure. more than two in a row? no. Ku' 'Laangah't is valid.