Re:Web App Security Best Practices
by bluesnowmonkey on Wednesday July 18, 2012 @03:02PM
(#4262311)
Wow, they had to write their own code to do localization safely with regard to XSS. I'm surprised that's not already available off the shelf.
[ Parent
| on HN ]
Re:Web App Security Best Practices
by jamessocol on Wednesday July 18, 2012 @03:18PM
(#4262398)
It's the weird combination of gettext, HTML, and user-supplied data that causes problems. But yeah, kind of surprising there isn't already something. That's why we moved the |fe filter up to jingo, as high and shared as we could.