Comment on JavaScript ( (__ = $ + $)[+$] + ({} + $)[_/_] +({} + $)[_/_] )parentComments−gcb15yeasy. show it to him and ask "in 1 to 5, how does that code look like the code you ship to production currently".any answer other than "Zero" or "wtf-look", do not hire.−Natsu15y> any answer other than "Zero" or "wtf-look", do not hire.What if you're hiring someone to test for XSS exploits?−MichaelApproved15yTesting for XSS exploits isn't production code so the answer should still be zero.−Natsu15yIt could certainly appear in the source of an XSS scanner that tried to inject code like that everywhere it could find.
Comments
easy. show it to him and ask "in 1 to 5, how does that code look like the code you ship to production currently".
any answer other than "Zero" or "wtf-look", do not hire.
> any answer other than "Zero" or "wtf-look", do not hire.
What if you're hiring someone to test for XSS exploits?
Testing for XSS exploits isn't production code so the answer should still be zero.
It could certainly appear in the source of an XSS scanner that tried to inject code like that everywhere it could find.