Re:The silent majority in software
by chrischattin on Monday August 29, 2022 @09:22AM
(#32637880)
???
XSS has long been a solved problem.
Security is definitely not an argument for using front end JS frameworks as they add attack vectors and complication to the stack.
Re:The silent majority in software
by shadowgovt on Monday August 29, 2022 @09:49AM
(#32638204)
Assuming your entrypoints are typed, TypeScript makes it much harder to accidentally mishandle data of the wrong type and frameworks make it much harder to inadvertently change state at a distance in a way that was unintended. These are the two most common ways that undesired behaviors are introduced to JavaScript UIs.
Is your solution something like “always remember to sanitize user-generated content”?
Re:The silent majority in software
by dc-programmer on Monday August 29, 2022 @07:42PM
(#32644944)
It’s definitely not a solved problem. Most developers absolutely would not escape their outputs if left to their own devices
Today, the frameworks bite me in the ass about once a week, but I think it’s worth it to get safe React with strict TypeScript, and plenty besides.
Caveat: All infrastructure requires a lot of maintenance, though! YAGNI still applies, and hopefully you have (or are on) a team dedicated to supporting the tools that you do need.