Re:It’s time to kill the web app
by sp332 on Saturday September 23, 2017 @05:24PM
(#15321814)
If the length is not pre-defined, the input has to be parsed to look for the closing tag. That makes your code vulnerable if the input tricks it into finding the wrong closing tag. But if the length is fixed, you don't have to parse it at all. That would avoid a whole class of vulnerabilities.
[ Parent
| on HN ]
Re:It’s time to kill the web app
by dgoldstein on Saturday September 23, 2017 @05:44PM
(#15321925)
True, assuming that programmers don't compute code (HTML,SQL, etc) from user input and miscompute the length of a fragment.
It would be interesting to see if this idea could work in practice.
A simple example could be the Twitter API's handling for references (URLs/hashtags/at-user mentions) in a tweet [0]. The tweet text is returned in one field, and all references are listed in a different field together with first/last character index within the tweet where that reference was found. You don't need to parse the tweet text yourself, just display it as plain text and insert links where the references say you should.
[0]: https://dev.twitter.com/overview/api/entities-in-twitter-obj...
Re:It’s time to kill the web app
by mike_hearn on Sunday September 24, 2017 @08:34AM
(#15324443)
This isn't some theoretical design. Any native application that uses a binary protocol framework like protobufs over TCP to communicate with the backend will benefit from this approach.
Re:It’s time to kill the web app
by mwcampbell on Sunday September 24, 2017 @02:32PM
(#15325849)
> protobufs over TCP
I guess it would have to be protobufs over TLS, and abuse port 443, to get through firewalls from hell.