My Own Python Web Framework

Re:My Own Python Web Framework by ptx on Wednesday February 22, 2023 @04:40PM (#34903290)

The second example from the documentation [1] disagrees. It displays HTTP header values, which are user supplied, without properly encoding them.

Also, it's not just about JavaScript. If values aren't properly encoded as HTML, the app is just plain broken when it tries to display text that contains certain character sequences. For example, the app is not capable of displaying the data value "To create a heading in HTML, use <h1>My heading</h1>".

The values need to be separated from the format string and passed through an encoding function such as html.escape [2].

[1] https://github.com/healeycodes/jar#fresh-pages

[2] https://docs.python.org/3/library/html.html#html.escape

[ Parent | on HN ]

Re:My Own Python Web Framework by Jiocus on Wednesday February 22, 2023 @05:49PM (#34904165)

Sure, you're right about that and I agree with the specifics, but your message doesn't feel relevant to the OP or the discussion.

Is it a reasonable expectation that every dev and blog posts must rehash all of OWASP and audit their experimental frameworks (now several years in the making) before publishing?

[ Parent | on HN ]

Re:My Own Python Web Framework by ptx on Wednesday February 22, 2023 @06:02PM (#34904300)

Templating is a core concern of a web framework, so a fundamental design flaw in the templating mechanism seems relevant.

[ Parent | on HN ]