3 ms·

Cursor build a pseudo-sethtml: https://github.com/skorotkiewicz/pseudo-sethtml https://github.com/skorotkiewicz/pseudo-sethtml

exdeejay_ 1y ago
This code only does the most basic and naive regex filtering that even a beginner XSS course's inputs would work against. With the Node example code and input string: <p>Hello <scr<script>ipt>alert(1)</scr<script>ipt> World</p> The program outputs: $ node . <p>Hello <script>alert(1)</script> World</p> { sanitizedHTML: '<p>Hello <script>alert(1)</script> World</p>', wasModified: true, removedElements: [], removedAttributes: [] } Asking a chatbot to make a security function and then posting it for others to use without even reviewing it is not only disrespectful, but dangerous and grossly negligent. Please take this down.
- codedokode 1y ago
  I wonder why Cursor chose regex approach when it is widely known that it is a wrong method. Is it a result of training on low-quality forums for beginners?
  - deleted 1y ago
    [deleted]
  - foldr 1y ago
    It does seem like a weirdly bad result. I got something more sensible that used DOMParser when I gave GPT-5 the following prompt: > Write a JavaScript function for sanitizing arbitrary untrusted HTML input before setting a DOM element’s innerHTML attribute. I won’t post it here in case someone tries to use it, but it wasn’t just doing regex munging.
  - bilekas 1y ago
    It doesn't really matter, but if you ask it the exact same prompt it will give different results everytime. And if you don't know how to write one properly yourself, you really shouldn't be blindly trusting Ai to produce something correctly. But these are the source of all future employment of developers and engineers who actually know things.
sph 1y ago
node.ts:52: const regex = new RegExp(`<\\/?${tag}[^>]*>`, "gi"); node.ts:72: const regex = new RegExp(`\\s+${attr}\\s*=\\s*["'][^"']*["']`, "gi"); node.ts:94: const tagRegex = /<(\w+)[^>]*>/g; https://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags/1732454#1732454 https://stackoverflow.com/questions/1732348/regex-match-open... LLMs are not intelligent enough to figure that the post is non-satirical and you should indeed avoid parsing HTML with regexes. On the other hand, there is a non-zero chance that a vibe coded HTML parser will eventually include obscure references to ritual infanticide and other eldritch entities of the Basic Multilingual Plane.

exdeejay_ 1y ago

This code only does the most basic and naive regex filtering that even a beginner XSS course's inputs would work against. With the Node example code and input string: <p>Hello <scr<script>ipt>alert(1)</scr<script>ipt> World</p> The program outputs: $ node . <p>Hello <script>alert(1)</script> World</p> { sanitizedHTML: '<p>Hello <script>alert(1)</script> World</p>', wasModified: true, removedElements: [], removedAttributes: [] } Asking a chatbot to make a security function and then posting it for others to use without even reviewing it is not only disrespectful, but dangerous and grossly negligent. Please take this down.

codedokode 1y ago
I wonder why Cursor chose regex approach when it is widely known that it is a wrong method. Is it a result of training on low-quality forums for beginners?
- deleted 1y ago
  [deleted]
- foldr 1y ago
  It does seem like a weirdly bad result. I got something more sensible that used DOMParser when I gave GPT-5 the following prompt: > Write a JavaScript function for sanitizing arbitrary untrusted HTML input before setting a DOM element’s innerHTML attribute. I won’t post it here in case someone tries to use it, but it wasn’t just doing regex munging.
- bilekas 1y ago
  It doesn't really matter, but if you ask it the exact same prompt it will give different results everytime. And if you don't know how to write one properly yourself, you really shouldn't be blindly trusting Ai to produce something correctly. But these are the source of all future employment of developers and engineers who actually know things.

sph 1y ago

node.ts:52: const regex = new RegExp(`<\\/?${tag}[^>]*>`, "gi"); node.ts:72: const regex = new RegExp(`\\s+${attr}\\s*=\\s*["'][^"']*["']`, "gi"); node.ts:94: const tagRegex = /<(\w+)[^>]*>/g; https://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags/1732454#1732454 https://stackoverflow.com/questions/1732348/regex-match-open... LLMs are not intelligent enough to figure that the post is non-satirical and you should indeed avoid parsing HTML with regexes. On the other hand, there is a non-zero chance that a vibe coded HTML parser will eventually include obscure references to ritual infanticide and other eldritch entities of the Basic Multilingual Plane.