3 ms·
Rephrasing the question, pessimistically (ideally as kindly as possible, but my intent could easily be lost): I've implemented a [complex?] white-listing solut
by j_s 14y ago
Rephrasing the question, pessimistically (ideally as kindly as possible, but my intent could easily be lost):
I've implemented a [complex?] white-listing solution to a problem in a domain where there is a long history of developer mistakes, passing user input to a 3rd-party technology most developers only know the minimum required for their job. Isn't injection impossible?
Edit: Sorry for any confusion; this was my way of saying 'this is only bulletproof if you got every edge case 100% right; few security experts make guarantees of impossibility of failure'.
- bni 14y agoHow about a black listing solution? commit block on anything containing the full word "Statement" (or equivalent in in your language of choice). Also code review, of which there will be need for plenty, when bare minimum developers is involved.
- j_s 14y agoFor the record, it's my understanding that white-listing is normally better than black-listing. I didn't mean that white-listing wasn't the best option, just that it sounded like it was being used.