Reddit Programming
201 subscribers
1.22K photos
126K links
I will send you newest post from subreddit /r/programming
Download Telegram
JavaScript's date parser is out of control and needs to be stopped
https://www.reddit.com/r/programming/comments/1rx4lb3/javascripts_date_parser_is_out_of_control_and/

<!-- SC_OFF -->I recently spent an afternoon learning that JavaScript has a very generous definition of "date." new Date("2020-01-23") // Wed Jan 22 2020 19:00:00 GMT-0500 Makes sense. ISO format, midnight UTC, so it shows up as January 22 in the Western Hemisphere. new Date("Today is 2020-01-23") // Thu Jan 23 2020 00:00:00 GMT-0500 OK, it pulled the date out of a sentence, which might be helpful in some cases. And interestingly, the time shifted, which is a little odd. new Date("Route 66") // Sat Jan 01 1966 00:00:00 GMT-0500 It thinks "Route 66" is referring to the year 1966? That's definitely a stretch. new Date("Beverly Hills, 90210") // Mon Jan 01 90210 00:00:00 GMT-0500 Year 90,210? Are you kidding me?! Turns out that most popular JavaScript engines have legacy parsers that really, really want to help you parse dates. We had a bug in our app were addresses and business names were being displayed as dates. The reason was that we were using the Date constructor as a fallback parser to catch unexpected formats. The fix was simple, but the bug made us laugh when we first saw it. And we learned to not treat the Date constructor as a validator. Full blog post which explains the parsing logic: https://futuresearch.ai/blog/javascript-thinks-everythings-a-date/ <!-- SC_ON --> submitted by /u/robertgambee (https://www.reddit.com/user/robertgambee)
[link] (https://futuresearch.ai/blog/javascript-thinks-everythings-a-date/) [comments] (https://www.reddit.com/r/programming/comments/1rx4lb3/javascripts_date_parser_is_out_of_control_and/)
How I found CVE-2026-33017, an unauthenticated RCE in Langflow, by reading the code
https://www.reddit.com/r/programming/comments/1rybo2x/how_i_found_cve202633017_an_unauthenticated_rce/

<!-- SC_OFF -->I wrote up a vulnerability research case study on how I found CVE-2026-33017, an unauthenticated RCE in Langflow. The key lesson was that the original problem was bigger than one vulnerable function. A dangerous execution pattern had been handled in one place, but another code path still exposed it through public flow execution. The article walks through the reasoning process, code review approach, and why “fixing the reported spot” is sometimes not enough. <!-- SC_ON --> submitted by /u/SadCryptographer4422 (https://www.reddit.com/user/SadCryptographer4422)
[link] (https://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896) [comments] (https://www.reddit.com/r/programming/comments/1rybo2x/how_i_found_cve202633017_an_unauthenticated_rce/)
Help wanted
https://www.reddit.com/r/programming/comments/1rykcea/help_wanted/

<!-- SC_OFF -->So if one were to want a computer program that can make a 3d model off of a GPS. That also can cancel out linear motion (say if one were in a train and used the GPS to draw a picture) i would want to see just the drawn thing not all of the trains linear motion blurring it out. who would be one to help me with that? (link cause forced to) <!-- SC_ON --> submitted by /u/GatoGrande340 (https://www.reddit.com/user/GatoGrande340)
[link] (https://x.com/grande340) [comments] (https://www.reddit.com/r/programming/comments/1rykcea/help_wanted/)