4 ms·
Wow. I find it stunning that in 2015,there is still engineers who execute user inputs without any kind of sanitization.
by r0naa 11y ago
Wow. I find it stunning that in 2015,there is still engineers who execute user inputs without any kind of sanitization.
- fisadev 11y agoThe input is sanitized: https://github.com/prometheus-ar/vot.ar/blob/master/msa/voto/gui/templates/pantallas/ingresodatos/datos_personales.html#L14 https://github.com/prometheus-ar/vot.ar/blob/master/msa/voto... It's just that people are too eager to scream "vulnerability!" without properly checking it before.
- r0naa 11y agoCorrect me if I am wrong but client side sanitization does not really count. It is really easy to bypass that check (send packets directly to the backend or use dev tools for example)
- fisadev 11y agoNo, because it's not a website with a network between the backend and frontend. It's a desktop app, with no network connection, just using html for the gui. Nobody can send packages to it.