Hacker News new | past | comments | ask | show | jobs | submit login

Why would you ever trust user provided input? Like seriously, ever?

I don't trust my own input. I tend to copy&paste, and I've messed up from pasting something that was previously in the clipboard because I didn't actually hit the right keyboard shortcut when I was copying the data I thought I was. I wasn't even attempting to be malicious, but I accidentally tried a SQL Inject attack on myself because of it.

DON'T EVER TRUST USER PROVIDED INPUT!!! AHHHHH!




Eh. I think it's pretty reasonable that people assume their logging library doesn't have random RCE, and I think it's pretty reasonable people aren't going to be able to filter every parameter based on Log4J having a relatively obscure bug.


think about the complexity involved in a modern backend. those log messages are flowing through logging libraries and a local syslog at an absolute minimum. more exotic setups involve consolidators, indexing/searching, user interfaces that may be controlled by any number of operators. moreover, those who use these tools typically have the keys to the kingdom for their respective environments.


Right! What would filtering even look like? This seems like an unreasonable burden on the developer.


I agree, but certain operations need to safely accept untrusted input if I'm going to handle input at all. Running a regex on user input doesn't mean I trust the input. It means I trust my regex engine. I should be able to trust my logger the same way.


if your logger is running an eval, you shouldn't trust it one bit


The issue is, what counts as "trust"? Logging input isn't trusting it. Or at least it's not supposed to be.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: