Javascript Basic Types

[u/hsnice]

[u/alzee76]

Haha what? God you're clueless. TTFN.

[u/inabahare → u/alzee76]

Then enlighten me oh wise one. Define the fumction, have it return a value and show me it evaluates to the function name

[u/alzee76 → u/inabahare]

I'm not in the business of finding exploits in random JS engines for anonymous children on the internet. I am in the business of writing code for a living and as such, follow defensive programming practices.

I know that bugs can exist in interpreter or compiler string interpolation implementations, and that they also can exist in poorly written code that uses those features without having to exploit an underlying weakness in the interpreter. For example, with poorly sanitized inputs. I also know that if I don't use interpolation, than any and all bugs surrounding it cannot be used as exploits against my code.

Therefore, if you actually care about the security of your app/service, you shouldn't use it. Interpolation offers no benefit except allowing you to be lazy, and if you value laziness over security, the rest of your code probably sucks too.

[u/inabahare → u/alzee76]

Would have saved you a lot more time to just say "damn, I was wrong" and moved on. But I guess you had to pull even more stuff out of wherever so here we are.

Like just take a step back and look at all of the qualifiers you have to add to your point. "Well it could be that you might have a bad implementation" but you don't. The amount of security you get with interpolation vs concatination is none. No less or no more. But you do get code that is a hell of a lot cleaner.

const res = `Hello! My name is ${firstName} ${lastName}`;

is so much cleaner and clearer than

const res = "Hello! My name is " + firstName + " " + lastName

and it's no less secure. Bringing up lack of sanitation doesn't work for you because you still have to sanitize with concatination.

And the SQL example is pointless because it doesn't show a problem with interpolation, but rather a problem with not sanitizing your input. A thing that would happen if you used concatination just the same. And to the smartass who inevitably brings it up, I am aware that you shouldn't use either for SQL

[u/alzee76 → u/inabahare]

damn, I was wrong

Well except I'm not.

Like just take a step back and look at all of the qualifiers you have to add to your point.

There are none. Interpolation doesn't pass the smell test. It's bad coding style. It opens your code up to security risks.

Period. No qualification.

Bringing up lack of sanitation doesn't work for you because you still have to sanitize with concatenation.

Concatenation is better than interpolation because you can sanitize the values safely. You cannot do that with interpolation. Period.

[u/inabahare → u/alzee76]

It opens your code up to security risks.

And if there were I'm sure you'd be quick to mention them, instead of speculate about what issues there might be ;)

Concatenation is better than interpolation because you can sanitize the values safely. You cannot do that with interpolation. Period.

const sanitize = val => `Sanitized ${val}`;
const interpolated = `You can't sanitize with interpolation? Well I just ${sanitize("a value")}`;

Except I just mocked it for you ;)

I could call an actual sanitizing function, but I can't imagine you're that ignorant

[u/alzee76 → u/inabahare]

The function sanitize is still itself being interpolated into the string.

I can't imagine you're that ignorant

The irony is strong in this one considering this is the third time I've explained this to you. I'm not going to explain it again. Hopefully the next black-hat that owns some site you code this way because you're lazy will take pity on you.

[u/inabahare → u/alzee76]

Man you really are that ignorant . But then again you like to pull stuff out of your ass ;)

Pretend you've explained things all you want, but all you've managed to come up with are speculations. Which, is just sad

[u/WikiSummarizerBot → u/alzee76]

Defensive_programming

Defensive programming is a form of defensive design intended to ensure the continuing function of a piece of software under unforeseen circumstances. Defensive programming practices are often used where high availability, safety, or security is needed. Defensive programming is an approach to improve software and source code, in terms of: General quality – reducing the number of software bugs and problems. Making the source code comprehensible – the source code should be readable and understandable so it is approved in a code audit.

^{[ F.A.Q | Opt Out | Opt Out Of Subreddit | GitHub ] Downvote to remove | v1.5}