Conversation

Notices

1. Kirino Kousaka (kirino@seal.cafe)'s status on Wednesday, 31-Jan-2024 00:49:25 JST Kirino Kousaka

   in reply to

   • cassidyclown
   • Rusty Crab
   • Phantasm
   • Zambia
   • mischievoustomato

   Yeah, I guess the argument is "should it ignore entirely or fix the potentially unsafe part"

   For me I'd personally just fix the unsafe part, but I can understand the logic for not wanting to do that and taking a potentially "safer" route.

   Hopefully I understood your point.

   • Phantasm (phnt@fluffytail.org)'s status on Wednesday, 31-Jan-2024 00:49:26 JST Phantasm

     • cassidyclown
     • Rusty Crab
     • Zambia
     • mischievoustomato
     @Kirino @RustyCrab @cassidyclown @diurnalfreak666 @mischievoustomato
     > It's apart of the parser which cleans up potential malicious code?
     Depends on the point of view. It shouldn't interpret what it got from backend as something safe IMO. It should check if the content makes sense and escape what doesn't make sense. If I send you an HTML formatted message with line-height: 1000px, do you expect the frontend to break and display it with that CSS? Probably not. Same goes for the tag, it should check if it tag is supposed to be interpreted or not.