Re:pfSense: Open source network firewall distribution
by rgrove on Friday February 10, 2017 @02:54PM
(#13618332)
I don't mean to be combative, but when providing an example of how you're planning to mitigate vulnerabilities, it seems unwise to use code that contains an easily avoidable XSS vuln. I love pfSense and have used it for years, but this sort of thing doesn't inspire confidence.
[ Parent
| on HN ]
Re:pfSense: Open source network firewall distribution
by gonzo on Friday February 10, 2017 @03:22PM
(#13618550)
Understood. It wasn't provided in the example, because it is not a user-entered item and is rarely displayed on the screen. It is typically an index. In other cases (perhaps) because people who originally wrote it knew no better.
(There is a lot if "isnumeric()" stuff used around $id. I inherited this codebase.)