3 ms·
Although this is correct, the real way to handle XSS vulnerbilities is to default deny and encode all data, like Django does. Require the developer to whitelist
by rmc 14y ago
Although this is correct, the real way to handle XSS vulnerbilities is to default deny and encode all data, like Django does. Require the developer to whitelist some parts.
Relying on injecting the data and then looking for it in a fancy 3d view is not a very robust way to do it.
- mfontani 14y agoUsing Perl, I love how Text::Xslate does exactly that by default, unless you "| mark_raw" the data that you know needs instead to be interpreted as HTML. That's the way to do it!