3 ms·
What was actually invalid about that input? Why shouldn’t that html escaped string be shown as is to the user? I guess I would tweak my first comment and say i
by ec109685 3y ago
What was actually invalid about that input? Why shouldn’t that html escaped string be shown as is to the user?
I guess I would tweak my first comment and say input filtering is not enough. You must do output filtering to truly be safe.
- tsimionescu 3y agoI don't get how you use the term "output" here. However you put it, the problem was feeding the user's input to ERB.new(). The most general solution would have been something that accepted any string, but escaped it properly for ERB.new, I think we all agree on that. But that escaping still needs to be done on the input, not the output of ERB.new. If they were able to inject code there, the output doesn't even matter: you've already lost by the time you get a return, the malicious payload has already run, it doesn't matter what its output was.
- ec109685 3y agoMy point was that the web page that the researcher compromised takes input from user and creates a neon version of it. It should be just fine to pass in any character to the site, so a regex deny list is the wrong approach.