Hacker News Reader

Hacker News

Comment by tester34 | Hacker News Reader

Full thread

tester34

but, what's the actual issue?

XSS?

what's the vector attack here?

where the `text` comes from?

View on HN

Text like "I'd like to meet you one day & murder you very horribly with a rather large sword" will pass sentiment analysis because everything after the "&" will bypass the check.

but is this security issue?

Being able to bypass a check sounds like a security issue to me.

but wouldn't it be the problem with deserialization on the server side?

edit. oh I see, somebody can overwrite other params, yea?

It could be client side, where you're using it to hide content from someone who doesn't want to see something potentially abusive.

I did assume the example was client side, but it might not be. The server may be using it to avoid adding a comment to a database if it's abusive. URLSearchParams exists in Node too https://nodejs.org/api/url.html#url_class_urlsearchparams. There are fetch polyfills available, but the plan is to add it to node.

isn't this something that's being executed client side? why trust it at all?

This is why you clean data on the server side. It will only "bypass" anything if the backend developer was asleep.

I don't think the author does a good job explaining the security problem, but I believe what they meant is something similar to:

text="foo&sendPasswordTo=hacker" or text="foo&admin=1"

You can imagine a potentially dangerous parameter and value being passed.

This still seems like a server issue regardless? Using URLSearchParams doesn't mean your server wont see a request with `&sendPasswordTo=hacker`. Sure its nicer on the client side but it doesn't solve the security issue

There is no security issue here. The security check must be done on the server side. That's it. This article is wrong on the internet.

People can already send whatever body they want to your API endpoint. Your client side cleaning won't matter

Reply on news.ycombinator.com