- Feature Articles
- CodeSOD
- Error'd
- Forums
-
Other Articles
- Random Article
- Other Series
- Alex's Soapbox
- Announcements
- Best of…
- Best of Email
- Best of the Sidebar
- Bring Your Own Code
- Coded Smorgasbord
- Mandatory Fun Day
- Off Topic
- Representative Line
- News Roundup
- Editor's Soapbox
- Software on the Rocks
- Souvenir Potpourri
- Sponsor Post
- Tales from the Interview
- The Daily WTF: Live
- Virtudyne
Admin
I got nothing to say about this one. Thinking about it a bit more, maybe "Kill it with fire" ?
Admin
And make sure the fire is what you get for burning carbon subnitride in ozone. (For reference, that's a flame hotter than the "surface" of the Sun...)
(1) Also known as dicyanoacetylene, N≡C-C≡C-≡N.
Addendum 2024-02-28 17:22: Bah: N≡C-C≡C-C≡N
Admin
Also, the
Message
string is written raw into the response. Let's hope that string gets sanitized earlier in the logic, so it doesn't also create an HTML injection vulnerability on top of being already terrible code. Reassure me, the string gets sanitized, right? Right?Admin
Some other issues:
Admin
Admin
Upper-case HTML: check
language attribute: check
inline script output for messaging: check
confusing Java and JavaScript at the backend: check
I mean, this is code that has proven its use for 25 years or more now! What is there to criticize?
Admin
Good point. Kill it with magnetism then :-)
Admin
Nuke it from orbit. It's the only way to be sure.
Admin
alert() is a bad way to alert the user if the application is recent enough, and targeted recent enough browsers, to have portable alternatives. But it's old software, using conspicuously old syntax, so probably not.
Admin
alert
has been considered a bad choice for like, 20 years or so.Admin
Classical XSS waiting to happen here. Unless this is demo code for a worst case tutorial, of course...
Addendum 2024-02-28 15:55: typical double post :(
Admin
I will from now refer to ASP as ASPEN and I will go out in the woods and cut me a thick branch of ASPEN so I can use it to reprogram anyone that calls JavaScript Java.