Comment by n_e
6 hours ago
The "data" is part of the tax simulation source code, not untrusted input, so such an attack vector doesn't exist.
6 hours ago
The "data" is part of the tax simulation source code, not untrusted input, so such an attack vector doesn't exist.
Yet. You’re adding one other thing that authors need to keep in mind when developing the product, fixing bugs, and adding features. The fact that the input must be trusted is not an intrinsic part of the business logic, it’s an additional caveat that humans need to remember.
What exactly do the developers need to keep in mind?
Well think about this from a product perspective. A natural extension of this is to be able to simulate tax code that hasn’t been implemented yet. “Bring your own facts” is practically begging to be a feature here.