Hacker News Reader

Text like "I'd like to meet you one day & murder you very horribly with a rather large sword" will pass sentiment analysis because everything after the "&" will bypass the check.

View on HN

This is why you clean data on the server side. It will only "bypass" anything if the backend developer was asleep.

but is this security issue?

Being able to bypass a check sounds like a security issue to me.

but wouldn't it be the problem with deserialization on the server side?

edit. oh I see, somebody can overwrite other params, yea?

It could be client side, where you're using it to hide content from someone who doesn't want to see something potentially abusive.

I did assume the example was client side, but it might not be. The server may be using it to avoid adding a comment to a database if it's abusive. URLSearchParams exists in Node too https://nodejs.org/api/url.html#url_class_urlsearchparams. There are fetch polyfills available, but the plan is to add it to node.

isn't this something that's being executed client side? why trust it at all?

Reply on news.ycombinator.com