3 ms·
I don't think this is a good example, because the regex does just that: it doesn't try to filter out bad input, it specifically only accepts known good input. I
by tsimionescu 3y ago
I don't think this is a good example, because the regex does just that: it doesn't try to filter out bad input, it specifically only accepts known good input. If the regex did what it was meant to do, only allowing strings composed of ascii letters and numbers, and space, than the code would have not been exploitable.
- floxy 3y agoStill seems like that is broken. Shouldn't they be escaping whatever control characters? Like if your user wanted to highlight "Now 75% off". Seems like it is reasonable to want to allow that.
- tsimionescu 3y agoThat's a completely different problem: it may be too closed. But it's definitely not a fail open system. It's a fail closed system with a bug.
- floxy 3y agoYeah but the real bug is the trying to roll-your-own, instead of using a `ERB.escape_tainted_input` method or somesuch. Either that method doesn't exist, which seems like major mis-feature, or the author didn't know about it, or didn't want to use it.
- wrsh07 3y agoWhoops you are absolutely right!! Good point, I totally misread the if/else.