Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Newsboard – A Hacker News Clone

newsboard.robdelacruz.com

Post reply on HN
Print view View original

11–19 of 19 posts

Re: Show HN: Newsboard – A Hacker News Clone

#11

Post by willio58 »

jenoer wrote: post #8

@robdelacruz: I have a few security-related findings for you that you might want to take a look at: - I can inject any JavaScript in Titles, Tags and possibly other locations. - By manually changing the value of the `userid` cookie, I can log in as any user ("1" for admin). This also allows me to access the admin section of the website. - It's highly recommended to enable "HttpOnly" for session cookies. (Secure and S…

This is hilarious, people are having a javascript alert conversation on this site.

Re: Show HN: Newsboard – A Hacker News Clone

#12

Post by zxcvbn4038 »

jenoer wrote: post #8

@robdelacruz: I have a few security-related findings for you that you might want to take a look at: - I can inject any JavaScript in Titles, Tags and possibly other locations. - By manually changing the value of the `userid` cookie, I can log in as any user ("1" for admin). This also allows me to access the admin section of the website. - It's highly recommended to enable "HttpOnly" for session cookies. (Secure and S…

This is why we can’t have nice things! Citibank had the same issue five or six years ago where once you logged in you could change the URL to any account. I think they lost something like $36 million before the hole was plugged.

Re: Show HN: Newsboard – A Hacker News Clone

#14

Post by robdelacruz »

jenoer wrote: post #8

@robdelacruz: I have a few security-related findings for you that you might want to take a look at: - I can inject any JavaScript in Titles, Tags and possibly other locations. - By manually changing the value of the `userid` cookie, I can log in as any user ("1" for admin). This also allows me to access the admin section of the website. - It's highly recommended to enable "HttpOnly" for session cookies. (Secure and S…

Thanks for the bug reports. Much appreciated. Will take a look at these one by one. Hopefully to get the site back up and running.

Source code is at: https://github.com/robdelacruz/newsboard

Re: Show HN: Newsboard – A Hacker News Clone

#15

Post by robdelacruz »

iKevinShah wrote: post #3
freetonik wrote: post #2

Looks neat and tidy. Is it open source?

The first link on the demo is this - https://github.com/robdelacruz/newsboard Seems like the source > newsboard - a bulletin board and bookmark sharing site (inspired by HackerNews)

OP here. Right, that's the source:

https://github.com/robdelacruz/newsboard

I used plain css from scratch to keep it small. I tried to copy the HackerNews look, but using Flex instead of Tables.

Re: Show HN: Newsboard – A Hacker News Clone

#16

Post by robdelacruz »

(OP here) Hi guys, thanks for checking out newsboard.

Source code is here https://github.com/robdelacruz/newsboard

I will look into fixing the security bugs to get the site back up and running. Feel free to check out the code.

If you have time to waste, check out my "unix fortune2" web page to get your unix fortunes. It's a clone of 'unix fortune':

http://fortune2.robdelacruz.com/

Re: Show HN: Newsboard – A Hacker News Clone

#17

Post by robdelacruz »

robdelacruz wrote: post #16

(OP here) Hi guys, thanks for checking out newsboard. Source code is here https://github.com/robdelacruz/newsboard I will look into fixing the security bugs to get the site back up and running. Feel free to check out the code. If you have time to waste, check out my "unix fortune2" web page to get your unix fortunes. It's a clone of 'unix fortune': http://fortune2.robdelacruz.com/

Site is up again: http://newsboard.robdelacruz.com/

Re: Show HN: Newsboard – A Hacker News Clone

#18

Post by krapp »

It looks like you're using HTML form maxlength attributes to determine the maximum length for elements. I hope you're also validating that on the server somehow, because of course anyone can simply delete those before posting.

Remember, no one even has to go through your form to make a POST request to one of your endpoints (unless maybe you're using CSRF tokens, which you don't seem to be). Never assume that what you send to the user has any relationship to what they send back, and never validate on the front end.

Re: Show HN: Newsboard – A Hacker News Clone

#19

Post by robdelacruz »

krapp wrote: post #18

It looks like you're using HTML form maxlength attributes to determine the maximum length for elements. I hope you're also validating that on the server somehow, because of course anyone can simply delete those before posting. Remember, no one even has to go through your form to make a POST request to one of your endpoints (unless maybe you're using CSRF tokens, which you don't seem to be). Never assume that what you…

You're right, there's no validation on the server. Need to fix those.

As quick fix to get the site up and running again, I just trimmed off any overly long title or cat beyond a certain limit of chars.

Post reply on HN