Public Chat Web Application Source Code on GitHub

#1

Post by bisratyalew » Wed, Feb 06, 2019, 7:59 AM UTC

Public Chat Web Application Source Code on GitHub
github.com

Re: Public Chat Web Application Source Code on GitHub

#2

Post by geekuillaume » Wed, Feb 06, 2019, 9:36 AM UTC

Nice work! Some time age I worked on a similar project for a client but with much bigger scaling needs (300k+ concurrent connections). My client authorized me to publish the project with an open licence. It's available here if you want to take a look: https://github.com/geekuillaume/chatup

Re: Public Chat Web Application Source Code on GitHub

#3

Post by Krasnol » Wed, Feb 06, 2019, 9:46 AM UTC

Interesting. Someone somehow attempted to open a new tab with pornhub while I was in the demo chatroom. Nothing was visible in the chat itself.

Re: Public Chat Web Application Source Code on GitHub

#4

Post by dvcrn » Wed, Feb 06, 2019, 9:48 AM UTC

Uhm, yeah it works but it's just a barebones chat using socket.io or am I missing something here?

Re: Public Chat Web Application Source Code on GitHub

#5

Post by magnetomax » Wed, Feb 06, 2019, 9:50 AM UTC

It needs to sanitize the input text. Very important from security perspective.

Re: Public Chat Web Application Source Code on GitHub

#6

Post by makepanic » Wed, Feb 06, 2019, 9:50 AM UTC

dvcrn wrote: post #4

Uhm, yeah it works but it's just a barebones chat using socket.io or am I missing something here?

Including no input/output sanitization which leads to XSS issues.

Re: Public Chat Web Application Source Code on GitHub

#7

Post by doque » Wed, Feb 06, 2019, 9:51 AM UTC

Krasnol wrote: post #3

Interesting. Someone somehow attempted to open a new tab with pornhub while I was in the demo chatroom. Nothing was visible in the chat itself.

Probably XSS: https://github.com/BisratYalew/Real-Time-Public-Chat/blob/ma...

Re: Public Chat Web Application Source Code on GitHub

#8

Post by annnoo » Wed, Feb 06, 2019, 10:00 AM UTC

makepanic wrote: post #6

dvcrn wrote: post #4

Uhm, yeah it works but it's just a barebones chat using socket.io or am I missing something here?

Including no input/output sanitization which leads to XSS issues.

I did something similar for a university project to show why input/output sanitization is so important. Very simple project (~100 lines iirc) but it did the job!

https://github.com/annnoo/websocket-chatxss

In my oppinion the most fun thing you can inject is the "Katamari"-Script: http://kathack.com/

Re: Public Chat Web Application Source Code on GitHub

#9

Post by freddie02 » Wed, Feb 06, 2019, 10:09 AM UTC

open console. type this setInterval(() => {$('.msg_send_btn').click()},50);