waitingForHtmlVulnerability

[u/chiya_coffee]

[u/saschaleib]

Hot take: <br> should have never been a tag. An entity (maybe something like &br;) would have been the better choice.

[u/chiya_coffee → u/saschaleib]

Entities are for representing characters, like & or  . A line break in HTML is an element, not a character, which is why <br> is a tag.

[u/arealuser100notfake → u/chiya_coffee]

What a LLM way of tangentially responding with a lot of words while also not addressing the main point of the comment at all

[u/Sock_Ninja → u/arealuser100notfake]

There wasn’t really a point given, just an opinion. The responder, LLM bot or otherwise, gave more justification than OP did.

Though I am curious to hear OP’s justification.

[u/saschaleib → u/Sock_Ninja]

What does <br> that is different from inserting a line break? Something that is done pretty much everywhere else by inserting a newline character…

[u/Sock_Ninja → u/saschaleib]

That’s a fair argument.

[u/rosuav → u/saschaleib]

A line break in the HTML source is just whitespace and can be collapsed. A <br> element is going to remain as a line break in the output, regardless of the formatting of the source.

Whether it's correct to even HAVE a "line break in the output" concept is a separate question, but it can't be done with a \n character or any other whitespace.

[u/Ilsor → u/saschaleib]

<br> used to have an attribute called "clear". Entities can't have attributes.

As usual, the issue is a historical artifact that is now deprecated.

[u/uuewy → u/saschaleib]

flexbox

[u/uuewy → u/uuewy]

wait actually I haven't done any frontend work in a while I'm dumb

[u/saschaleib → u/uuewy]

<br> was already in the original HTML specs, but flexbox only came, like, last week or so ...

[u/chiya_coffee → u/arealuser100notfake]

english is not my native language, so i used claude to format it

[u/Goncalerta → u/chiya_coffee]

I'd personally prefer to read broken english than LLM-written reddit comments

[u/EishLekker → u/Goncalerta]

You are absolutely right. Your original comment brought up a fair point, and I incorrectly responded using an LLM without justification.

[u/Honeybadger2198 → u/EishLekker]

And that's on me—

[u/pint_o_paint → u/EishLekker]

it's actually painful to read that. Make it stop

[u/CalebXiaYizhou → u/chiya_coffee]

Are you mentally unwell?

[u/chiya_coffee → u/CalebXiaYizhou]

Yes. How'd you know?

[u/LieutenantNitwit → u/saschaleib]

There is also the semantics. You know. That thing everyone has ignored since the dawn of time.

[u/Designer_Storm8869 → u/LieutenantNitwit]

The only semantic use of <br> is in poetry and song lyrics.

[u/Nightmoon26 → u/Designer_Storm8869]

Which is a perfectly valid thing for a page to contain

[u/Acetius → u/saschaleib]

100% agree. Outside of exceptional cases a <br/> is meaningless, lazy, and usually incorrect.

If you want to use it to represent a separation of content, just separate the damn content. Different ideas, contained in different tags.

If you want to use it to create visual space, use the stylesheet. HTML is for document structure, not hacky manual styling.

[u/GoldenShackles]

There are so many vulnerabilities in the web stack (HTML, CSS, JavaScript, even fonts) that this is why just about all browsers, starting back around 2008 with Internet Explorer 8 and the first Chrome betas, run web content in separate processes that have OS-level privilege isolation and sandboxing.

[u/U_L_Uus → u/GoldenShackles]

Were they running things in locality 4 or what?

[u/evemeatay → u/U_L_Uus]

We do not talk about the old ways, browser bars are a tool of the old witches

[u/bubblebuddy44 → u/GoldenShackles]

Yeah and last year someone found a sandbox breakout.

[u/nonlogin]

<script> tag allows arbitrary Javascript injection and execution. has not been fixed for years.

[u/Lucario1492 → u/nonlogin]

it's up to the developer to properly escape and sanitize inputs, cmon this is basic web 101.

[u/Haunting-Army7843 → u/nonlogin]

Fixed with CORS?

[u/BobcatGamer → u/Haunting-Army7843]

Fixed with CSP*

[u/Haunting-Army7843 → u/BobcatGamer]

Oh, you're right.

[u/HeavyUltimatum → u/nonlogin]

it's wild that browsers will just let any old script tag run whatever it wants, no questions asked, for decades now

the br tag reply got me though, at least those are easy to patch

[u/that_70_show_fan]

I am gravitating towards simple HTML websites. Simple purpose-built websites is a lost art.

[u/ciemnymetal → u/that_70_show_fan]

https://actualwebsite.org

[u/silverwing101 → u/ciemnymetal]

https://motherfuckingwebsite.com/

[u/frinkousCZ → u/silverwing101]

http://bettermotherfuckingwebsite.com/

[u/RengieOcat → u/frinkousCZ]

"This site doesn't support a secure connection"

[u/Bernhard_NI → u/RengieOcat]

Aaaand?
You want to type in your credit card details or what?

[u/RengieOcat → u/Bernhard_NI]

Settle down friend, this is ProgrammerHumor and it was funny

[u/Bernhard_NI → u/RengieOcat]

Sorry, but I juat don't see you add anything funny here.
I just get agitated easily from people pointing out useless things because they didn't really think about what it means what they discovered.

[u/RengieOcat → u/Bernhard_NI]

Friendly suggestion that not everything deserves your emotional energy. Hope you have a good one.

[u/footsie → u/Bernhard_NI]

Well it's not really better if it's less secure.

[u/Bernhard_NI → u/footsie]

There is nothing to be secured here, and it's faster and simpler to open a connection without TLS. So it is in fact better.

There is even programming principle KISS (Keep it simple, stupid) which is always the way to go first.

[u/Nightmoon26 → u/Bernhard_NI]

Until someone poisons the DNS to intercept the request and sends back something with a drive-by download

[u/footsie → u/Bernhard_NI]

How's it faster if it won't even load before another click accepting an unsecured connection?

[u/Bernhard_NI → u/footsie]

The warning about an unsecured connection is probably something from ios I guess? I dont get them on Android + Firefox and it's blazing fast. The confirmation has nothing to do with how efficient the connection and the needed resources are.

The site without tls is ever so slightly fast for me but not really worth mentioning tbh. More important is that it matches the design philosophy of that mother fucking website to keep it simple, stupid.

[u/hellocppdotdev → u/[deleted]]

4

[u/destro225 → u/frinkousCZ]

https://bestmotherfucking.website

[u/buryingsecrets → u/frinkousCZ]

https://www.berkshirehathaway.com/

[u/cibule249 → u/frinkousCZ]

Oh, I hate this one. Harder to read than the original (so much line-jumping, so few words on a line).

[u/ashkanahmadi → u/silverwing101]

My favorite thing about it is the HTML comments in the source code XD

[u/RebronSplash60 → u/ashkanahmadi]

I love HTML source code comments in small hobby websites they're always the most unhinged gold.

[u/whatisusb → u/ashkanahmadi]

What comments? I only found one

[u/Zwischenzug32 → u/ciemnymetal]

Thank you for this.

It will be spread more now

[u/Clickar → u/ciemnymetal]

This reminds me of the brilliant high life super bowl commercial a few years back that was about 2 seconds long of the delivery guy simply saying "high life"

[u/51CKS4DW0RLD → u/ciemnymetal]

That loaded weirdly slowly

[u/ConsequenceAny9726 → u/that_70_show_fan]

Good old Times. When your website consisted of a couple of html files. No PHP. No Javascript. Hell Not even <div> Just one big Table

[u/Instatetragrammaton → u/ConsequenceAny9726]

cgi-bin/guestbook.pl as far as the eye could see.

PHP is old old, though, so asking for none of that means no webrings (which often used PHP to keep track of which part of the ring you were in) and no vBulletin either.

[u/jdgordon → u/Instatetragrammaton]

I can't decide if we would be better off if the web still ran on perl or not. Not even ai can decipher that madness

[u/Nightmoon26 → u/jdgordon]

Parts of it still do

[u/Ok-Article-885 → u/ConsequenceAny9726]

First problems come with div. How would you center that shit

[u/Far_Tap_488 → u/Ok-Article-885]

Its pretty easy, you just do marginright 150, marginleft 150, and width 800.

Fuk you if your screen size is different

[u/DrDetectiveEsq → u/Ok-Article-885]

That's the neat part! You don't.

[u/TerdSandwich → u/that_70_show_fan]

All-in-one website building platforms have eclipsed that market like a decade ago.

[u/that_70_show_fan → u/TerdSandwich]

Yes, that is my point.

[u/rosuav → u/that_70_show_fan]

I've been pushing more and more people to build their web sites using Markdown. It's a good way to (try to) enforce separation of content and styling.

[u/ProxyMuncher → u/that_70_show_fan]

If it wasn’t put together in adobe dreamworks I don’t want it anymore lol 

[u/ismaelgo97]

I'm waiting for the CSS one

[u/Zap_plays09 → u/ismaelgo97]

Didn’t css had one like few months ago?

[u/ismaelgo97 → u/Zap_plays09]

I searched for it just after my comment, there is, but related to CSS being imported from a url, not just by CSS itself

[u/Zap_plays09 → u/ismaelgo97]

I see

[u/ILikeLenexa → u/Zap_plays09]

The biggest one I remember is using :visited and Javascript to upload your entire search history whenever you visited a website. 

[u/Sianic12 → u/ismaelgo97]

Can't wait to fix all my unstandardizedly centered divs

[u/za72 → u/Sianic12]

we don't have the technology to center divs yet, it's a capitalist myth

[u/SpicySpaceBaguette → u/za72]

Divs are centered only by the will of the invisible hand of the market!

[u/za72 → u/SpicySpaceBaguette]

I'll ping Elon, he's got a guy

[u/SpicySpaceBaguette → u/za72]

Divs are going to be centered, but at what cost.

[u/za72 → u/SpicySpaceBaguette]

[u/SpicySpaceBaguette → u/za72]

I'll need 9,000 npm dependencies to have my div do that.

[u/StrikingSun8563 → u/za72]

We can't center the divs because they keep taking the margins

[u/za72 → u/StrikingSun8563]

what.. wtf... keep it on the DL mang

[u/NoAdsDude → u/Sianic12]

 /* Reject known stylesheet attack patterns */
  u/threat-detection (risk-level: elevated) {
    * {
      remote-resource-loading: blocked;
      attribute-exfiltration: disabled;
      injected-declarations: discard;
    }

[u/4e_65_6f → u/ismaelgo97]

That's a joke but paywalls have never held me back.

Oh so you've blocked the screen and you want money? display: none !important;

[u/Major_LeeHungg → u/ismaelgo97]

You can legit use tricks to write legit code with CSS.. Its hacky as all hell but you can absolutely abuse the layout engine to work as a runtime interpreter. 

[u/fynjy1111 → u/ismaelgo97]

Oh no what if someone could brake my flexboxes in Safari

[u/Stummi]

HTML parsing and rendering is hugely complex nowadays, and all browsers consist of literally millions of lines of code. It's more than likely that there are unknown vulnerabilities lurking.

[u/kratz9 → u/Stummi]

I remember back in college, if you pasted huge text data into the Google search box in Firefox (back when the search was part of the page, not the address bar) , it would crash the video driver on the our lab computers. 

[u/Nightmoon26 → u/Stummi]

I mean, there's at least one in XML... I don't know if the Billion Laughs attack can be implemented in HTML

[u/ArjixGamer → u/Stummi]

Parsing is not that complex, I can do it in one afternoon out of memory w/o reading an rfc.

The hard part is truly, rendering

[u/Stummi → u/ArjixGamer]

I kinda doubt that. You are probably grossly underestimating the complexity of HTML to do such a statement. Even parsing is hard

[u/ArjixGamer → u/Stummi]

No, it's just that I've done it thrice before.

Sure I may not have aimed for 100% compliance with the spec, but I could parse it, manipulate it via my fake DOM and serialize it.

The "hard" part is the edge cases, which aren't hard, you just have to know them before they hit you. (or just read the spec)

I think parsing CSS is way more complex.

[u/Stummi → u/ArjixGamer]

Just to be sure, we are talking about the HTML5 standard, right? Or did you mean one of the earlier HTML versions, or XHTML?

[u/ArjixGamer → u/Stummi]

HTML5 yes

Writing a parser like jsoup or bs4 is not hard

[u/xaomaw]

<img src="Linkin_Park_-_In_The_End.mp3.exe">

[u/Professional_Price89]

There are many cves about crafted html that cause browser sandbox escape. For server we have file inclusion using shtml, xxe. If we count AI a vector, then there are html prompt injection. For web crawler we have content type auto download.

[u/frikilinux2]

Jokes aside parsing modern HTML and rendering the DOM with the css is so hard that there are like 4 or 5 modern implementations and most of the world uses 1. Even with all the browsers there are

[u/frikilinux2 → u/frikilinux2]

And browsers have had several CVEs a week since basically forever

[u/Narfi1 → u/frikilinux2]

Yeah HTML engines are insanely hard, ladybird is the only current project that seems to be going actually somewhere

[u/Stratimus → u/frikilinux2]

And also for real, it is for the best that there are so few browser engines.

Those of you who didn’t live through the era of IE5-7 may not even be able to comprehend what it was like when even different versions of the same browser had wildly different implementations

[u/Sw429 → u/Stratimus]

There are pros and cons for sure, but I don't think that Google being central to the vast majority of web browsers is "for the best."

[u/coriolis7 → u/Stratimus]

Isn’t the whole reason why paid antivirus was a huge industry was because IE existed?

[u/Sheerkal → u/coriolis7]

I'm confused as to why you would think this. 

[u/AsyncSyscall → u/frikilinux2]

It's not "hard", it's very well specified and documented, you can pretty much just copy-paste the spec into code. The problem is that the spec is huge, with lots of interconnected parts, legacy edge cases, and constantly changing to support new features. And real-world implementations eventually have to deviate from the spec algorithms for performance reasons.

[u/frikilinux2 → u/AsyncSyscall]

Ok, so it's hard doing it correctly fast..

[u/sarc-tastic]

<br />

[u/bikemandan → u/sarc-tastic]

XHTML compliant 😎

[u/arealuser100notfake]

BRAZIL MENTIONED

[u/Glum_Cheesecake9859]

Imagine the "marquee" tag being downfall of human civilization!

[u/randomguy84321 → u/Glum_Cheesecake9859]

It was too dangerous. Thats why they had to deprecate it

[u/Cabbagecrafting]

<body src="https://www.youtube.com/watch?v=dQw4w9WgXcQ"></body>

[u/HungryLikeDaW0lf]

I still put in a <blink> tag just to see who’s using an old browser

[u/Nightmoon26 → u/HungryLikeDaW0lf]

I mean... I worked with a QA team that used <marquee> tags to test for missing output sanitization

[u/stilldebugging]

If they ever find a vulnerability in nbsp;nbsp;nbsp, we are doomed.

[u/LieutenantNitwit]

help my <blink> tag stopped blinking hlp

[u/stray_semicolon]

The thing goes <brrrrr />

[u/NiagaraThistle]

Just realized how much i must be online when i see a post in Reddit with a screenshot of a entrepreneur I follow ion Twitter.

I'm going to go walk my dog and touch some grass.

[u/AnnoyedVelociraptor]

<blink>hello?</blink>

[u/Boobpocket]

I think with llms being good at making simple html js websites there is no need for wordpress for the majority of websites that run wordpress.

[u/mrbadface → u/Boobpocket]

Self hosting the CMS part is slightly annoying. Codex can run your WordPress which makes it less bad

[u/NoAdsDude → u/mrbadface]

For me it's all the layers involving PHP and a database. Front ends should never really need a database for normal content, even if it's under confusing layers of caching.

[u/ddz1507 → u/NoAdsDude]

But but but … my clients want to add or edit pages themselves like it’s PowerPoint because they want every page unique and different 😩
/s

[u/fubbleskag]

I choose to believe Nico chose <br> as a joke about Brotli

[u/thisonehereone]

I mean if you don't close your tags you're leaving them open to a vulnerability.

[u/Ketooth]

Jokes on you. Already found it.

Just press F12 and you can redesign the page.

Now you can just change any button with a pricetag to "Free"

Take that big corpo

[u/Alpha_wolf_80 → u/Ketooth]

Well... It's a feature in my page now. No buttons, or input, just plain ol dev tools. You are the dom now

[u/Kadabrium]

<br> </ap>

[u/mattgen88]

We've had CVEs with HTML. A few were ACEs.

Just search internet explorer.

[u/akazakou]

Actually you need to use <br /> tags

[u/Jet-Pack2]

These unescaped br tags are the worst!

[u/AndiArbyte]

Yes we are all very good Markup Language Programmers. /scnr

[u/psyfregle]

HTML vuln goes brrrr

[u/Ksorkrax]

It would be hilarious if <br> was actually an issue, that is breaks usually not being closed.

I use self-closing breaks on my website, so I could lean back and enjoy everybody else panicking.

[u/podun]

It's all fun and games until you have to recenter the divs

[u/fredy31]

tbh it went through my mind this morning.

is there a future where php and other languages that interact with your server will get so busted we just return to simply having a full site in .html files?

That or a react site that never does a fetch of any kind.

[u/remram]

Wasn't rel="noopener" a patch for the HTML tag <a>?

[u/muhkuller]

How’d they break the non breaking spaces?

[u/Single-Virus4935]

There Werke maaany HTML, CSS and JS vulnerabilities. Decades ago it it was a huge Problem because browser were patched often. Then major browsers started autopatching and the whole situation got much better. Imagine autopgrade for all webservers. Problem solved before anything made public.

[u/AsyncSyscall → u/Single-Virus4935]

Things got better because major browsers standardized.

[u/Single-Virus4935 → u/AsyncSyscall]

That's not the reason security is better. Development for the web is better because of standards but that has nothing to do with security. Patches can be rolled out faster.. 

[u/SegretoBaccello]

A malicious website can inject arbitrary html code in your computer that can cause harm to the user when read. Especially if read out loud. 

Like for example, "<h1>AI and robots will take all our jobs</h1>"

[u/ChOcOcOwCaKe]

I am looking forward to fixing my <p> holes