4 ms·
External entities in XML[1] were a similar issue back when everyone was using XML for everything, and parsers processed external-entities by default. 1: https:
by aidenn0 10mo ago
External entities in XML[1] were a similar issue back when everyone was using XML for everything, and parsers processed external-entities by default.
1: https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing https://owasp.org/www-community/vulnerabilities/XML_External...
- hinkley 10mo agoAt least with external entities you could deny the parser an internet connection and force it to only load external documents from a cache you prepopulated and vetted. Turing completeness is a bullshit idea in document formats.
- aidenn0 10mo agoWith SVGs you can serve them from a different domain. IIUC the issue from TFA was that the SVGs were served from the primary domain; had they been on a different domain, they would have not been allowed to do as much.
- actionfromafar 10mo agoPostscript is pretty neat IMHO and it’s Turing complete. I really appreciated my raytraced page finally coming out of that poor HP laser after an hour or so.
- aidenn0 10mo agoI once sent a Sierpinski's Triangle postscript program to a shared printer. It took 90 minutes, and pissed off everybody else trying to print.
- hinkley 10mo agoOne of the very first SVG documents I encountered was a port of the PS Tiger to SVG. It loaded a lot faster than the PostScript Tiger.
- bigfatkitten 10mo agoSounds almost like a fun crypto mining opportunity.
- anthk 10mo agoPostScript can emulate the ZMachine (Zork text adventures and all of infocom) with "zmachine.ps". Look it up at DDG/GG.
- zahlman 10mo agoHow does it do I/O?
- actionfromafar 10mo agoA monad. It’s just a class of abstract Endor Moon or something. Probably you have to send all commands up to the current state to it. :)
- gnerd00 10mo agocalling Leonard Rosenthol ...
- Sohcahtoa82 10mo agoXXE should have never existed. Whoever decided it should be enabled by default should be put into some sort of cybersecurity jail.
- GoblinSlayer 10mo agoIt's no different from links to googlesyndication in offline html docs.