5 ms·
I don't see the point of this article, it's just common sense. If you plan which parts of the DOM are replaced using HTMX, never trust user input. You'll be fin
by ackers 2y ago
I don't see the point of this article, it's just common sense. If you plan which parts of the DOM are replaced using HTMX, never trust user input. You'll be fine. I use Golang with HTMX and it's amazingly productive.
- ramon156 2y agoNot everyone's as knowledged, hence information should be shared
- qsort 2y agoI think the point is that htmx is in no way special. It's the same old category of vulnerability. It's why we have execvpe. It's why we have mysql_real_escape_string_no_really_we_mean_it_this_time(). I remember a similar point being made about LLM output. Now, I'm anything but a LLM fanboy, but if you pipe unknown text into a system interface that's squarely on you.
- yawaramin 2y agoAnd fortunately, it was https://htmx.org/essays/web-security-basics-with-htmx/ https://htmx.org/essays/web-security-basics-with-htmx/
- esjeon 2y agoI mean that's the point. Reminding people of possible dangers is one very important security mission.
- pessimizer 2y agoI think the point being made that you're replying to is that it has nothing to do with htmx. It isn't htmx that's not playing well with content security policy.
- yencabulator 2y agoUsing htmx effectively prevents using CSP for security hardening.