The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
32 views

Guessing HTML vs Plain Text and Entity Reference Character in HTML [migrated]

Input supplied as Text # Python 2.7 >>> bs4.BeautifulSoup("H&W Insurance") <html><body><p>H&amp;W Insurance</p></body></html> # Python 3.5.2 >&...
2
votes
0answers
72 views

Tainted String Type in Kotlin

Two of the top 3 security vulnerabilities in the OWASP Top 10 come from trusting user input (Injection and XSS). To deal with this, Ruby lets you "taint" Strings received from the user as unsafe. In ...
1
vote
0answers
62 views

How to escape regexes and paths in double quote strings without going crazy?

It often happens that after designing my regexp (on regex101.com) I want to paste it in my program. Consider this regexp that matches numbers and string (but keep in mind this is general question!): ^...
-1
votes
2answers
95 views

Is there any danger in rendering user-entered HTML and can it be mitigated?

I'm guessing the answer is no because there's quite a few examples, including right here. If I let users submit their own HTML text and then render it side by side, what could the user do that would ...
1
vote
1answer
194 views

Hypothetical : What restrictions will I need to add to Java so that I can remove its GC? [closed]

This is a hypothetical, yet very technically precise question I'm trying to ask all the compiler/static analysis programmers. I'm trying to understand the extent of prohibitive features I would need ...
2
votes
1answer
1k views

Optimized Special Character Escaper vs Matcher/Pattern

I need to escape special characters which are sent to apache lucent. Since the code will run on a production server I want the code to be the fastest possible. I've seen multiple ways to do it: ...
1
vote
1answer
641 views

pcre case insensitivity: handle escape sequences as raw bytes?

Consider the following regex (no unicode): Example:\x04\x05\x41 Suppose you search this regex case-insensitively. Would you expect it to search the final \x41 in case-sensitive manner? People whom ...
0
votes
2answers
648 views

How does Facebook strip html/apostrophes for XSS but also display it?

I'm not quite sure if this is a question for programmers.se rather than stackoverflow, but here goes. So Facebook [or any other large company] when given something like an apostrophe or html, can ...
2
votes
1answer
938 views

Does it make sense to sanitize email form input?

So, I'm expending this email submission form script for a client and saw something rather strange to my experience. As you can see below, the original programmer has sanitised the user input. Is this ...
1
vote
3answers
196 views

Escaping strings in database layer

Can escaping functions (e.g. mysql_real_esacpe_string ) be moved down to the database layer where we would loop through all parameters passed for all queries and escape all strings. Would that be a ...