Skip to content

Commit

Permalink
fix: resolve conflict
Browse files Browse the repository at this point in the history
  • Loading branch information
Yucohny authored Oct 30, 2023
1 parent 6f25b5b commit bbe37b8
Showing 1 changed file with 2 additions and 6 deletions.
8 changes: 2 additions & 6 deletions src/content/reference/react/experimental_taintUniqueValue.md
Original file line number Diff line number Diff line change
Expand Up @@ -67,12 +67,8 @@ experimental_taintUniqueValue(

#### 注意 {/*caveats*/}

<<<<<<< HEAD
* 从受标记的值派生新值可能会破坏标记保护。通过将受标记的值大写、将受标记的字符串值连接成较大的字符串、将受标记的值转换为 base64、对受标记的值进行子字符串操作以及其他类似的转换来创建的新值,除非明确调用 `taintUniqueValue` 标记这些新创建的值,否则它们不会受到标记。
=======
* Deriving new values from tainted values can compromise tainting protection. New values created by uppercasing tainted values, concatenating tainted string values into a larger string, converting tainted values to base64, substringing tainted values, and other similar transformations are not tainted unless you explicitly call `taintUniqueValue` on these newly created values.
>>>>>>> 4bdb87b172a7723d56d03a5630c8a9870f6f03ec
* Do not use `taintUniqueValue` to protect low-entropy values such as PIN codes or phone numbers. If any value in a request is controlled by an attacker, they could infer which value is tainted by enumerating all possible values of the secret.
* 从被污染的值派生新值可能会破坏污点标记保护。通过将被污染的值转换为大写、将被污染的字符串值连接成较大的字符串、将被污染的值转换为 base64、对被污染的值进行子字符串操作以及其他类似的转换来创建的新值,除非明确调用 `taintUniqueValue` 标记这些新创建的值,否则它们不会被污染。
* 不要使用 `taintUniqueValue` 保护诸如 PIN 码或电话号码这类低熵值。如果请求中的任何值受到攻击者的控制,他们可以通过枚举所有可能值判断哪个值是被污染的。

---

Expand Down

0 comments on commit bbe37b8

Please sign in to comment.