Tangential anecdote: I supported a product recently that had a password generator feature that admins could use to create a “random” password for a new user account. The password would be emailed to the user (the admin never saw it). The generator used a wordlist file that the developers must have grabbed from an online dictionary. It was about 10k words and contained MANY offensive ones. Pretty much any obscenity you could imagine and more. It was obvious no one had sanitized it.
I filed a bug a couple years ago but it still isn’t fixed. Luckily it’s a seldom used feature, and I haven’t seen anyone affected yet.
I filed a bug a couple years ago but it still isn’t fixed. Luckily it’s a seldom used feature, and I haven’t seen anyone affected yet.