News for hackers. Stuff that matters.

A comment on It’s time to kill the web app. Parent comment

Re:It’s time to kill the web app by aidenn0 on Monday September 25, 2017 @12:40AM (#15328111)
The two are very different:

    (html "user content")

    user content := " (script "something malicious")"

    (html "" (script "something malicious"))
the length-prefixed version cannot escape in this way.
[ Parent | on HN ]

There are no comments on this comment yet.