Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The curious case of the missing period

tjaart.substack.com

Post reply on HN
Print view View original

161–170 of 201 posts

Re: The curious case of the missing period

#161

Post by VBprogrammer »

cratermoon wrote: post #157
spankalee wrote: post #154

Earlier quoted context omitted.

> [1] - Templating systems themselves are thus a mistake belonging to this class This is not universally true. JavaScript has an amazing feature called tagged template literals which let you tag a string with interpolations with a function that handles the literal and interpolation parts separately. This lets the tag function handle the literals as trusted developer written HTML or SQL, and the interpolations as untr…

> If `name` is a user-provided string, it can never insert a or tag, etc., because it's escaped. Be careful with that "never". A curious and persistent person might discover a bug in the implementation, leading to something like the Log4Shell issue.

Not sure why you are being downvoted here. It's a fair point and properly escaping your data is only one part of the overall security picture but you should also be strictly validating data at the inputs to your system too.

Re: The curious case of the missing period

#162

Post by spankalee »

VBprogrammer wrote: post #161
cratermoon wrote: post #157

Earlier quoted context omitted.

> If `name` is a user-provided string, it can never insert a or tag, etc., because it's escaped. Be careful with that "never". A curious and persistent person might discover a bug in the implementation, leading to something like the Log4Shell issue.

Not sure why you are being downvoted here. It's a fair point and properly escaping your data is only one part of the overall security picture but you should also be strictly validating data at the inputs to your system too.

Luckily, for Lit specifically, the "escaping" is done by the browser by setting textContent, so the string literally never passes through the HTML parser. Any string is valid text content, and if you found a bug that permitted unsafe text to be parsed as HTML somehow, it would be a browser bug and a very, very serious one.

But it'd be similar with with other template systems. If the interpolation should allow any string, there's really no validation to be done.

Re: The curious case of the missing period

#164

Post by teddyh »

otterley wrote: post #25
teddyh wrote: post #17

I see two huge bad habits here. The first is the obvious one, as pointed out by many commenters here: Don’t implement standards haphazardly, if you even should do so yourself. Either give the implementations the necessary care and attention, or use a pre-made library. But the other thing is: Don’t vendor your dependencies. Those libraries you use need to be updated regularly and timely, and absolutely not “only as ne…

> Don’t vendor your dependencies. The alternative seems worse: your own application's stability is now at risk against upstream changes that could break your code. Sure, you might not get a fix immediately, but I'd rather know I'm making a change because I need a fix than introducing instability and additional risk that I don't want to subject myself to. "If it ain't broke, don't fix it."

You can choose to either live at the slightly-bleeding edge (as determined by “stable” releases, etc), or to live on the edge of end-of-life, as discussed here: https://news.ycombinator.com/item?id=21785399>

(And surely you should have tests to verify all your own functionality after upgrading a dependency?)

Re: The curious case of the missing period

#165

Post by barryrandall »

linsomniac wrote: post #82

Show of hands: Who knew exactly where this was going as soon as "SMTP" was mentioned?

I first encountered this when I was writing a WAP[1] mail client in ColdFusion[2]. I must have read the entire SMTP spec 20 times before I spotted my mistake.

[1] https://en.wikipedia.org/wiki/Wireless_Application_Protocol

[2] https://en.wikipedia.org/wiki/ColdFusion_Markup_Language

Re: The curious case of the missing period

#166

Post by partdavid »

leni536 wrote: post #141
partdavid wrote: post #65

Earlier quoted context omitted.

There's actually a lot of things that embed a SMTP client for sending mail that should use a host MTA. The reason is that the user who actually wants to use "the thing" is often just about able to enter an SMTP server, but there's no way "the thing" can trust that a properly-configured sender MTA like sendmail is configured. Companies have huge fleets of servers that can't send system mail, and it's often not really…

Use an SMTP library then.

Agreed, for sure.

Re: The curious case of the missing period

#167

Post by 256_ »

Sometimes I feel like I'm wasting my time by obsessively reading RFCs and specifications for the things I use. This made me feel better about that. And also much more smug.

Other than the obvious moral that protocols should be implemented properly, the moral of the story is that all abstractions are leaky, and it will always be useful to understand the lower levels.

Re: The curious case of the missing period

#168

Post by 256_ »

im3w1l wrote: post #85
vlovich123 wrote: post #70

Earlier quoted context omitted.

Learning to blindly follow a spec for the purposes of parsing the SMTP wire protocol doesn't give you extra ability to follow the state machine or distributed business logic specs better. It just adds to the overall opportunities for you to make a mistake. This also ignores the fact that SMTP specs is split across multiple RFCs with no single normative version which further complicates the probability that you implem…

> This also ignores the fact that SMTP specs is split across multiple RFCs with no single normative version which further complicates the probability that you implement the spec correctly in the first place. This is a point I agree with and the fact I see it mentioned so rarely, that standards are split across multiple RFC's makes me suspect that people don't mention it because they don't know because they never read…

It can get tedious and annoying, but I don't think it actually affects the likelihood that you'll implement something wrong. The RFCs link to each other when needed. Also groups of RFCs often get combined and edited into a single revised RFC for simplicity.

This makes me wonder: How could the IETF's approach to standardisation be improved? I'm not sure how to fix this problem without overhauling everything.

Re: The curious case of the missing period

#169

Post by pja »

akvadrako wrote: post #146
pja wrote: post #128

Earlier quoted context omitted.

At some point, all protocols include in-band signalling somewhere: You have to put packets on the line, and those packets are ultimately just a stream of anonymous bytes. If it wasn’t a period, it would be something else & you’d have to handle that instead.

That isn't true at all. In most binary protocols, you put the size of the message in the header. Then any sequence of bytes is allowed to follow. There are no escape sequences.

That’s still in-band signalling: The metadata is in the same channel as the data.

Re: The curious case of the missing period

#170

Post by pja »

treflop wrote: post #155
pja wrote: post #128

Earlier quoted context omitted.

At some point, all protocols include in-band signalling somewhere: You have to put packets on the line, and those packets are ultimately just a stream of anonymous bytes. If it wasn’t a period, it would be something else & you’d have to handle that instead.

From my experience, almost no protocols have in-band signaling. No protocol I’ve ever built has in-band signaling because it’s nuts. You always know what the next byte means because either you did a prefixed length, your protocol has stringent escaping rules, or you chose an obvious and consistent terminator like null.

If your metadata about the data is in the same channel as the data then you’re doing in-band signalling.
Post reply on HN