Treat URL as unsafe user input
PowerKiKi opened this issue · comments
https://ecodev.github.io/natural/list;ns=%22INVALID will crash the entire page because we incorrectly assume it is valid JSON. Since this can be edited very easily, we must assume nothing, and expect parsing failure silently from anything that comes from URL.
This should be reviewed in the entire lib.
Exceptions catched, but I did no more tests on the value as we can persist ":any" -> so any assumption on "parse" could lead to exclude potentially valid values.
If you have any specific inputs on what to check after parse, feel free to comment, but I think we're pretty okayish like this.