Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The offending code for those interested:

   const decodeEscapedXML = (str: string) =>
      str
        .replace(/&/g, "&")
        .replace(/'/g, "'")
        .replace(/"/g, '"')
        .replace(/>/g, ">")
        .replace(/&lt;/g, "<");
Seems like it's in multiple places in the code base too, I think all those clients are automatically generated.

https://github.com/aws/aws-sdk-js-v3/search?p=1&q=const+deco...

So that's not even a good fix, think he should have fixed

aws-sdk-js-v3/codegen/smithy-aws-typescript-codegen/src/main/resources/software/amazon/smithy/aws/typescript/codegen/decodeEscapedXML.ts



Very true. AWS doesn't pay me enough to spend time on a comprehensive fix, with tests.

Hopefully they will pay someone to do that.

At least I can read SQS messages now.


I've become a lot more sympathetic to this attitude lately.

I kind of enjoy working with Rust, and have written a few minor utilities to interact with AWS in it for work. I found and fixed a few bugs in the library for it, Rusoto. I observed along the way that the project is sorely in need of people to spend time on management and maintenance. I could do that, but...

I can't ignore that AWS makes some absurdly huge amount of money for Amazon. I don't begrudge them that, but I get paid pretty well at my day job already. Why do more of that work for the benefit of AWS for no money? They ought to pay me for it.

Hell, they have more than enough money to hire a team of professional experts in every language under the sun to maintain their AWS libs. Especially considering that the net effect of higher-quality AWS libs in more languages will result in more money being spent on AWS services and more lock-in. There's no excuse for having such terrible code in a mainstream language like Javascript.


By the way, in case you missed it yesterday: https://news.ycombinator.com/item?id=27080859


Yeah, but you've submitted a PR. It's not a fix, it's broken code. As soon as they run their code generator, it'll disappear.


Well it fixed their problem enough, and filing a PR was the level of effort they're willing to put in. It might help someone fix it properly, and it might help someone fix it enough to get moving, so it's potentially good for the origin and good for the users and if not, the origin can close the PR.


I'm getting very confused by this attitude.

It's broken code. It's bad code.

Never, ever submit bad code. You're just making even more work for everyone.

Its far worse than doing nothing at all. And if you want to highlight the problem, just raise an issue, point to the problem.


That's dreadful code.


Yeah and unpacking &amp; first is asking for trouble with say "&amp;amp;lt;" in your input


My god. I wish I could find a linter to ban startsWith and regex from my codebases. I swear 99% of their uses are buggy hacky shit


You may find semgrep handy for that, although I don't offhand know how to express "any use of regex" in its language

https://github.com/returntocorp/semgrep


Can‘t tell you how often I have to use StartsWith/Contains in some interface when connecting to applications together because of the missing ability to extract proper unique/primary keys for objects from any of the systems.

So please don‘t, I need these buggy hacks ;)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: