this post was submitted on 02 Jan 2024
835 points (99.4% liked)
Programmer Humor
32710 readers
406 users here now
Post funny things about programming here! (Or just rant about your favourite programming language.)
Rules:
- Posts must be relevant to programming, programmers, or computer science.
- No NSFW content.
- Jokes must be in good taste. No hate speech, bigotry, etc.
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Why would exporting a url break js? No one would be stupid enough to run JS from an input. This isn't like a sql query where you might think to put a string directly into a search query. You would have to actively add this exploit in.
It's not executing the code.
Their message contains brackets. Which is what the template engine is using to determine variations.
So the unsanitized user message is being processed by the temple engine, probably kills it with invalid formatting, and the engine no longer applies the templating to the rest of the message leaving the variations in the text sent to the messaging app.