81–90 of 92 posts
Earlier quoted context omitted.
No. Django solves the 90% problem, which is usually a fine approach but will llikely lead to security vulnerabilities down the line. I'll refer to something I wrote last time I had this argument: http://pavpanchekha.com/programming/injection.html .
You should replace your '<' with '<' if you're going to claim your page is xhtml.
Earlier quoted context omitted.
No. Django solves the 90% problem, which is usually a fine approach but will llikely lead to security vulnerabilities down the line. I'll refer to something I wrote last time I had this argument: http://pavpanchekha.com/programming/injection.html .
Nice article. In response to the last part I can think of a way to achieve the sort of smart escaping via template you talk about using Haskell and Hamlet (among other templating systems used by yesod). I believe, although I can't absolutely confirm that Hamlet already performs context appropriate escaping, based mostly on the type signatures and the names of a few of the functions.
I disagree with the articles premise that injection is always a display issue. In the [Yesod web framework](http://www.yesodweb.com) which uses Hamlet, we sanitize, not strip html by default before it is ever put in the database. The more you can make injection not a display issue, the better- you just have to know your options.
Earlier quoted context omitted.
This is actually a hard problem in the general case, and it is an active area of research. One promising approach is static taint analysis , wherein the source code of a web app is analyzed to detect whether "tainted" output is given to a sensitive "sink" without being properly sanitized. See, e.g., Omer Tripp et al., "TAJ: Effective Taint Analysis of Web Applications" (PLDI 2009) ( http://www.cs.tau.ac.il/~omertrip/…
That's a poor example. I would never send a document as HTML without tags. html_sanitize() should really be generate_html(), which adds structure to the document. What the GP is saying (and I agree with) is that generate_html() should use a library which understands HTML structure and only allows content to be generated using a strict API (no doc+=" bar " garbage). Such a discipline greatly reduces the chance of inje…
Earlier quoted context omitted.
That's a poor example. I would never send a document as HTML without tags. html_sanitize() should really be generate_html(), which adds structure to the document. What the GP is saying (and I agree with) is that generate_html() should use a library which understands HTML structure and only allows content to be generated using a strict API (no doc+=" bar " garbage). Such a discipline greatly reduces the chance of inje…
It's not a poor example, and it's not about sending the document without tags. It's about whether special characters should be escaped, and the answer depends on the Content-Type that the client requested.
Then, the framework could map different kinds of requests (e.g: raw content vs. html content) to different types.
Then, the only way to convert between the types are functions that do proper escaping.
They fixed it .. http://google.com/#q=$ {
If your templating language is going to use a magic character it would seem useful to pick something less common than $. There are several odd characters on my keyboard (§`~±|¤) and if you are willing to use the ALT key there are really obscure characters that you can safely filter from the input instead of going through the trouble of escaping them. Filtering is so much more efficient/easier/safer than escaping. Ima…
If your templating language is going to use a magic character it would seem useful to pick something less common than $. There are several odd characters on my keyboard (§`~±|¤) and if you are willing to use the ALT key there are really obscure characters that you can safely filter from the input instead of going through the trouble of escaping them. Filtering is so much more efficient/easier/safer than escaping. Ima…
~ is not unusual on the internet, it is used for home directory webspace http://www.proweb.co.uk/~matt for instance
Reading it now as a treatise from my younger self, though I didn't write it, I realise that spirit is lost. For a while it was "our" place but now we have to return to the underground.