3 ms·
I have started denying any kind of non-ASCII characters in the source code. I understand this is extremely limiting, but it does do the trick. For now.
by OptionOfT 1y ago
I have started denying any kind of non-ASCII characters in the source code.
I understand this is extremely limiting, but it does do the trick. For now.
- AnimalMuppet 1y agoI mean, someone could still run a string of printable characters into "decode" and then "eval"...
- OptionOfT 1y agoAt least that is visible in a PR.
- AnimalMuppet 1y agoThe decode and eval calls are always visible.
- OptionOfT 1y agoSecurity comes in layers. This is one layer.
- rkagerer 1y agoThis is an old-man rant, but the first time I saw Unicode I felt like I was looking at a train wreck coming from a long way off. It has too many edge cases, footguns and unintuitive artifacts like this. I wish we constrained its use to only where required. Text was so much easier to reason about and safer to manipulate in the ASCII days.
- OptionOfT 1y agoI don't think it's an old-man rant. I think experience comes with age, but I don't associate with old-man (yet). It's about safety.