It’s time to kill the web app

Re:It’s time to kill the web app by eadmund on Sunday September 24, 2017 @07:57AM (#15324355)

Or, e.g. my preferred encoding of HTML:

    (html "abc")

This guarantees that no matter what is inside "abc" it simply can't escape into the control stream:

    (html "This is not (malicious \"boo\")")

This is just a pretty display of what would actually be these bytes:

    (4:html29:This is not (malicious "boo"))

It doesn't matter what one puts in the atom: it can't escape and damage the control stream.

[ Parent | on HN ]

Re:It’s time to kill the web app by aidenn0 on Monday September 25, 2017 @12:40AM (#15328111)

The two are very different:

    (html "user content")

    user content := " (script "something malicious")"

    (html "" (script "something malicious"))

the length-prefixed version cannot escape in this way.

[ Parent | on HN ]