3 ms·
I look forward to the inevitable JSON path injection attacks given how widespread XPATH injection used to be. ( See https://owasp.org/www-community/attacks/XPAT
by xnorswap 2y ago
I look forward to the inevitable JSON path injection attacks given how widespread XPATH injection used to be. ( See https://owasp.org/www-community/attacks/XPATH_Injection https://owasp.org/www-community/attacks/XPATH_Injection for more info. )
- gonzo41 2y agoYep. Yep, Yep. You have to wonder why we can't just leave nice things alone.
- pwdisswordfishc 2y agoOnly as inevitable as the dearth of interpolation/parametrized query primitives… though whether the industry has actually learnt the bitter lessons of SQL injection remains to be seen. I don’t hold my hopes up too much.
- pydry 2y agoYou can just bypass the injection risk entirely by hardcoding the values as this example demonstrates: https://news.ycombinator.com/item?id=40246089 https://news.ycombinator.com/item?id=40246089 (I'm being sarcastic, obviously. You are 100% right)
- wmil 2y agoThis first came out in 2007 without picking up much popularity, so I wouldn't worry about it becoming widespread.
- philstu 2y agoThe standard was developed because its being used by so many people in so many ways with so many different implementations that a standard was required to align them all, so im not sure the "nobody is really using it" argument holds much weight.