> Maybe, people disagree with your contention that it's a bulletproof
> solution. I think it may have unintended consequences. It would then
> behave differently than similar CF functions. Both of these are bad
> outcomes - worse, to me, than the status quo.
>
> In any case, requiring a change to the CF source code isn't a
> bulletproof solution to any current problem.
Mmm... the only other CF functions that it has any similarity to
currently are SerializeJSON and wddx2js or cfml2js ... or if you want to
go out on a limb, xmlformat (which used to be problematic because CF's
built-in xml parser would choke on ' so they gave you this nifty
function to properly format strings for xml and then it breaks if
someone puts an apostrophe in it). Subsequent version(s?) have (I think)
made the native xml parser recognize the ' entity -- I don't
remember precisely - it may not be inserting ' anymore instead, but
I do remember testing it. But SerializeJSON successfully converts
complex data so that it doesn't error out if that string is found within,
whereas jsstringformat and cfwddx still don't. Formatting string
literals is a required subset of the functionality for SerializeJSON() --
formatting string literals is what jsstringformat() is for -- they
both perform that task differently. (#SerializeJSON("</script>")# vs.
"#jsstringformat("</script>")#") It's perhaps very slightly stranger
with cfwddx since its designed for complex data like SerializeJSON().
So a) the similarity to other functions argument is ... silly...
The only people who would be affected by this change would be people who
are currently using a wrapper function to add escaping for </script> in
addition to what jsstringformat already does, in which case they can
just rewrite or replace their wrapper, yay! I actually have been using a
wrapper that does precisely what I'm talking about for several years --
only outcome I've had is that my javascript doesn't break unexpectedly.
So b) I think it's at best unlikely that there would be "unintended
consequences".
Like the rest of it, this is just arguing against a quick and simple
solution for the sake of arguing against it.
--
s. isaac dealey ^ new epoch
isn't it time for a change?
ph: 503.236.3691
http://onTap.riaforge.org/blog
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to
date
Get the Free Trial
http://ad.doubleclick.net/clk;160198600;22374440;w
Archive:
http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:295635
Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
