Hacker News Reader

Comment by robertlagrant | Hacker News Reader

Even if it is structured data, it's ultimately passed to the browser as a string. If I put text in between two tags, and that text came from user input, how is it going to solve that? Does it autoencode as html entity tags anything coming out in a text node?

View on HN

While working on the HTML document in your program, you have it always represented as a tree of nodes, a nested list often. When you want to insert user input, that user input is available as a string (unless you first turn it into something else). When you put a string into that nested list, and then at the very end, when you form the response, ask SXML to turn your tree into the HTML string, SXML will error, because it wouldn't know how to handle the string.

(All the other nodes are symbols with potentially subtrees in them, which are also symbols with potentially more subtress in them.)

If you put your user input into one such node as a value of that node, lets say a paragraph tag <p>, then SXML sees the user input as it is, a string. It will make sure, that when it turns the tree into HTML, that string remains merely a string, by escaping things, so that for example when your string is <evil-tag-with attrs="bla"> this is exactly what will be seen as text inside your paragraph text, and not be interpreted.

Basically, SXML will render it like: "Oh, you want some string to be inside your p tag? Sure, can do ... This is what you wanted to be displayed to the user ... You didn't want to run that, did you? Nahh, because then you wouldn't have passed it in the SXML as text content of a p tag."

So I think the answer to your question is "Yes.".

Ah okay - so it uses some special type to represent html-encoded text, which is then valid to shove inside a text element? That sounds quite nice.

I don't think it uses some special type in any way. Rather, if you use sxml to build html in scheme and have a node in there that is a string, then the natural way to serialize this sxml into html will be to safely quote the string. Afterall, if you wanted html tags to be preserved and interpreted in the output, you would first parse the string into sxml and put that into your document. This is the difference between working with structured data vs. plain string interpolation.

But of course this only applies when you use sxml. Artanis apparently can also use plain strings or templates as responses, in which case you will have to take care of safely encoding things too.

SXML is a fairly old thing, but it isn't really typed. [0]

Rather, things are structured, so it's more like a in-memory representation of XML. It doesn't need to be serialised, only deserialised into XML's text syntax. In which case, each piece knows how it needs to be encoded.

           '(h1 (@ (id "greeting")) "Hi, there")

Its just lists of Symbol types, and string or other type values.

[0] https://en.m.wikipedia.org/wiki/SXML

Understood, but if I insert a string into a database that looks like this:

  <script>alert("yoov bin acked")</script>

And that's my username, if it's naively inserted inside some HTML it'll look like HTML to a browser.

So I was wondering if this framework auto-HTML-escapes strings inserted into places where text can go.

Reply on news.ycombinator.com