Hacker News Reader

Comment by FriedrichN | Hacker News Reader

What is the point of sanitizing input in JavaScript? One could easily bypass that and still put nasty stuff in the input.

I think this is a bad idea, I just know there will be people who will make applications that will rely entirely on this API with disastrous results.

View on HN

Never sanitize user data before storing it in your backend. Always sanitize user data before displaying it on the screen.

I would amend that slightly:

It's okay, but mostly a waste of time, to sanitize data before storing it.

You must sanitize data when outputting it.

Why? Because someone could get the data into storage in another way, or new vulnerabilities might be discovered that you aren't sanitizing for before storage.

The only positive I can think of, is you run, say a comment section on a news aggregator. You could let people freely type up their own markup in a <textarea>, accept it as is and just throw it at clients to clean on their own. Another great use I could think of, say you have an image upload service, assuming this would work with SVG as well, you could just serve all sorts of potentially malicious SVG and have the client remove all the script tags.

While I'd prefer the inputs stored server-side to be pre-sanitized, I can see the benefit for just not touching it and shrugging.

You would sanitize it on the receiving end

I didn't think of that. I assumed the backend would already have sanitized it.

Either way, I think there should be a warning that it should never be used for input sanitation.

Explain "easily bypass"?

To clarify, I was assuming this was going to be used for input sanitation. If it were used for that a malicious actor could see where a form or XHR call would post to and simply post the raw input to that endpoint, bypassing any sanitation.

Oh, no it's not meant for that. It's used for sanitizing untrusted outputs for display.

IMHO, the idea here is nowadays more and more people are using third-party libraries which is hard to trust and even worse while people `npm update` them with no idea what changed between versions.

Reply on news.ycombinator.com