Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Suggestion on handling input() calls to prevent injection
#3
Well, out of context quotes are rude hey!

Marquesas Wrote:This is literally impossible though, since the syntax of input is

Mostly true, this just elimitates the usage of a preprocessor macro to replace input() with another proc!

Most places where you use these kinds of statements, are completely fine, since the trouble happens in other input() calls
Code:
input("Select a gender for your character.","Your Gender",usr.gender) in list("male","female","neuter")
Like this one, so a simple find/replace would solve all, standing.. and missing issues but yeah Ugh, that button... and all that crap

Code:
usr.name = input("Choose a name for your character.","Your Name",usr.name)

Another solution would be to manually verify all input() calls, and verify that they use a proper way of sanitizing the output, or we just wait for lummox to implement it into the engine. http://www.byond.com/forum/?post=1913933
Reply


Messages In This Thread

Forum Jump:


Users browsing this thread: 1 Guest(s)