Show HN: HN comments sidebar bookmarklet
gist.github.com
Show HN: HN comments sidebar bookmarklet
1–10 of 14 posts
Re: Show HN: HN comments sidebar bookmarklet
#2Great!, would be cool if you added "transparency" slider to the overlay? Or ability to snap to split of both in same page as well as an overlay.
Re: Show HN: HN comments sidebar bookmarklet
#3There was an extension called Epiverse that used to do this + reddit comments, I dearly miss it. Although I began to notice that I was more concerned with the comments than the pages themselves.
Re: Show HN: HN comments sidebar bookmarklet
#4Very handy. Ironic that it cannot work with this very post due to github's CSP
Re: Show HN: HN comments sidebar bookmarklet
#5There was an extension called Epiverse that used to do this + reddit comments, I dearly miss it. Although I began to notice that I was more concerned with the comments than the pages themselves.
https://epiverse.co/
Relevant comment: https://news.ycombinator.com/item?id=30187483
Re: Show HN: HN comments sidebar bookmarklet
#6Very cool, would be nice to be able to somehow open all links from hn directly with the side-loaded comments!
Re: Show HN: HN comments sidebar bookmarklet
#7Very cool, would be nice to be able to somehow open all links from hn directly with the side-loaded comments!
Thanks! That’s even better — although I think you’d need to create an extension out of this to be able to do that.
Re: Show HN: HN comments sidebar bookmarklet
#8This is trivially vulnerable to XSS [1]. Someone can leave a comment of the form:
https://">alert(1)
[1]: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...
Re: Show HN: HN comments sidebar bookmarklet
#9This is trivially vulnerable to XSS [1]. Someone can leave a comment of the form: https://"> alert(1) and if you click the bookmarklet for the page that comment was discussing then their javascript will execute in your logged in context on that website. [1]: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...
Thank you for spotting this! I updated the code to escape some special characters.
For people reading this, the parent comment is referring to this line[1] from a previous revision of the gist.
[1]: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...
Re: Show HN: HN comments sidebar bookmarklet
#10This is trivially vulnerable to XSS [1]. Someone can leave a comment of the form: https://"> alert(1) and if you click the bookmarklet for the page that comment was discussing then their javascript will execute in your logged in context on that website. [1]: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...
Thank you for spotting this! I updated the code to escape some special characters. For people reading this, the parent comment is referring to this line[1] from a previous revision of the gist. [1]: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...
> For people reading this, the parent comment is referring to this line[1] from a previous revision of the gist.
That was not the line, it was linking to this innerHTML call: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...
Also as a defense mitigation I don't think escaping is ever going to be effective, it would be better to create anchor elements directly. With your current approach I can still XSS with, for instance:
https://"onmouseenter=alert(1)"