News for hackers. Stuff that matters.

A comment on VP of InfoSec at InVision on secure code development [audio]. Parent comment

Re:VP of InfoSec at InVision on secure code development [audio] by archgoon on Friday March 22, 2019 @01:03PM (#19464480)
What are the problems with using inheritance to handle this?

  class urlencoded extends String;

  class xsssanitized extends String;
then secure functions can be explicit about what type they need.

  void embedInPage(xssssanitized xssString);
[ Parent | on HN ]
Re:VP of InfoSec at InVision on secure code development [audio] by tptacek on Friday March 22, 2019 @01:24PM (#19464711)
Most modern frameworks, in all the mainstream languages, already have this feature, and it's usually the default. You still get XSS because you still have to override the filter to do custom HTML, but it helps a lot.
[ Parent | on HN ]
Re:VP of InfoSec at InVision on secure code development [audio] by archgoon on Friday March 22, 2019 @01:35PM (#19464844)
Right; I'm trying to understand the difference between this and the "units of measure" approach the grandparent was referencing.

(To be clear, your latter point is referring to things like 'dangerouslySetInnerHTML' in react?)

https://reactjs.org/docs/dom-elements.html#dangerouslysetinn...

[ Parent | on HN ]
Re:VP of InfoSec at InVision on secure code development [audio] by pcwalton on Friday March 22, 2019 @03:39PM (#19466121)
There isn't a difference, really. Inheritance is one way of implementing "units of measure".
[ Parent | on HN ]
Re:VP of InfoSec at InVision on secure code development [audio] by pvg on Friday March 22, 2019 @06:44PM (#19467651)
There are practical differences, though, such that it's often not implemented by subclassing string.
[ Parent | on HN ]