4 ms·
Care to comment more on the user exposed templates? I haven't done much of any web auditing in the last few years but I would have guessed that we collectively
by dpeck 12y ago
Care to comment more on the user exposed templates?
I haven't done much of any web auditing in the last few years but I would have guessed that we collectively had a decent handle on this with markdown/liquid/etc.
Are their some common errors devs are making with mature libraries?
- patio11 12y agoTemplating systems have an inherent tension between power and security. A lot of them will cough up straight code execution if you can phrase it nicely. (e.g. I've seen Markdown which does YAML syntax highlighting. This happened to be implemented by actually parsing the YAML. And that's the ballgame.) Or, for ones which only let you access methods on an object passed to you, sometimes the person implementing that feature is not on the same page with the guy who added User#promote_to_admin!