3 ms·
It's odd that you count completely on validation to catch problems like this, rather than escaping the output as well. Writing regex validations to prevent mal
by mrkurt 17y ago
It's odd that you count completely on validation to catch problems like this, rather than escaping the output as well. Writing regex validations to prevent malicious input seems like a seriously error prone thing to be doing.
- qeorge 17y agoAgree. Not trying to give you guys a hard time, but Twitter has had several vulnerabilities caused by unescaped user supplied data being output without sanitization. Obviously I'm on the outside looking in, but IIRC rendering user pages is not particularly taxing on Twitter, to the point that they aren't cached. Would adding a simple sanitization routine have significant impact?
- al3x 17y agoNormally, we escape output as well. These fields were (foolishly) considered "trusted" and allowed to be rendered without escaping.