Play defense against user-generated content, at the right layer
Quote
prime prime directive number one, when it comes to protecting your JavaScript from random user generated content is, you know, tag tag stripping within HTML, right?
Episode 75: Liquidifying for Love (episode page, opens in a new tab) 00:05:22 (play audio from this timestamp, opens in a new tab)
Voice-matched
Summary
Helipad shows messages from random people on the internet, so rule one is stripping HTML tags so nobody can inject a script tag. Dave ran his strip-tags function over the whole JSON block. That broke on an innocent '<3' heart emoji and froze the app, a lesson in sanitizing at the right layer.
Also said
Episode 59: double down nothing once again welcome everybody to the board meeting (approx., from transcript intro) 00:06:32 (play audio from this timestamp, opens in a new tab)
so you're only allowing the things you block everything and only allow the thing you want.
Voice-matched