The Un parsing Manifesto Reconnecting our Corpus Callosum

The speaker, who runs product security at a cloud database company, opens by criticizing the habit of relying on input sanitization to stop cross-site scripting and injection. Using examples of strings that are harmless in one context and dangerous in another, the talk argues that whether data is safe depends on the output context where it lands, not on the characters themselves.

A recurring example is a review website that allows limited formatting. The same user content may be displayed, later mined for data, or searched during a legal dispute, and each use needs different handling. The talk also notes that bans on certain characters break real names and that developers already depend on output encoding through parameterized queries, escaping libraries and streaming encoders, which are easier to test and contain.

The proposed approach is to parse user input into a canonical intermediate representation, check permissions against that structure, and then emit it into whatever format is needed through verified encoders. In the questions, the speaker says sanitization still has a limited role, mainly filtering spam, and that effort is better spent on verifiable output encoders. The main takeaway for practitioners is to make the code that writes data understand the format it writes into.