Some time back there was an attack on Lemmy where (if I recall correctly) HTML embedded in emoji allowed tokens of users viewing the emoji to get stolen… which included administrators auth tokens. There was much havoc wrecked that evening.
The mitigation for this was “all HTML entities are escaped”. Doesn’t matter where they are - they’re escaped. This sometimes leads to them being doubly escaped when rendering. Less than, ampersand, and greater than all get doubly escaped ( > & < ).
… And that gets interesting as I can’t quite tickle that issue.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !programming@programming.dev
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person’s post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
Follow the programming.dev instance rules
Keep content related to programming in some way
If you’re posting long videos try to add in some form of tldr for those who don’t want to watch videos
Some time back there was an attack on Lemmy where (if I recall correctly) HTML embedded in emoji allowed tokens of users viewing the emoji to get stolen… which included administrators auth tokens. There was much havoc wrecked that evening.
The mitigation for this was “all HTML entities are escaped”. Doesn’t matter where they are - they’re escaped. This sometimes leads to them being doubly escaped when rendering. Less than, ampersand, and greater than all get doubly escaped ( > & < ).
… And that gets interesting as I can’t quite tickle that issue.
Canadian Aboriginal syllabics to the rescue!