2 ms·
SQL Injection and XSS are actually great examples of vuln classes where the winning strategy is safe APIs rather than diligent sanitization. "Just sanitize all
by UncleMeat 2y ago
SQL Injection and XSS are actually great examples of vuln classes where the winning strategy is safe APIs rather than diligent sanitization. "Just sanitize all your user inputs" is hard to do correctly because it is difficult to create automatic rules that detect every single possible violation.
Prepared statements and safe HTML construction APIs plus some linters that scream at you when you use the unsafe APIs works like magic.
- bflesch 2y agoYou're correct. It's about distinction between code and data. You should simply discern between HTML elements (code) and HTML text nodes (data). Same with prepared statements: Clear distinction between SQL code vs SQL data. You just need to ensure that your data is never interpreted as code.
- 0xbadcafebee 2y ago> You just need to ensure that your data is never interpreted as code. That's sanitization. Many different languages implement this. The old-school method is "tainting" data so it can't be used as part of execution without an explicit function call to "untaint" it. Same is used for "secret" data in various programs where you don't want it leaked.