Re:Don’t try to sanitize input, escape output (2020)
by AnonHP on Thursday January 13, 2022 @12:55PM
(#29924092)
> Sanitizing the input is wrong. Actively, objectively, unrecoverably wrong.
I agree on the “unrecoverably” (sic) part, but strongly disagree on words like “objectively”. It can be bad only if the input sanitization is poorly done. If that’s poorly done, then it’s also likely that the output sanitization may be poorly done. One cannot then say that output sanitization is objectively bad because someone doesn’t know or care enough to do it properly.
This is a complex topic that deserves more attention, not hand waving away with claims that cannot stand on their own.
I agree on the “unrecoverably” (sic) part, but strongly disagree on words like “objectively”. It can be bad only if the input sanitization is poorly done. If that’s poorly done, then it’s also likely that the output sanitization may be poorly done. One cannot then say that output sanitization is objectively bad because someone doesn’t know or care enough to do it properly.
This is a complex topic that deserves more attention, not hand waving away with claims that cannot stand on their own.