Show HN: Markdown HN profiles at {user}.at.hn

Post by jstanley » Mon, Jun 10, 2024, 1:32 PM UTC

sccxy wrote: post #21

jstanley wrote: post #15

I updated my profile but I don't see any change on my at.hn page - how long does it cache for?

You failed at step 1 of instructions... > To opt-in, paste "{your username}.at.hn" anywhere in your profile's 'about' section.

Post by diggan » Mon, Jun 10, 2024, 1:34 PM UTC

padolsey wrote: post #19

mike-cardwell wrote: post #11

There seems to be some weird encoding issues and failure to convert URLs to links properly, for my profile - https://mike-cardwell.at.hn/ - Also, some of the indenting and white space is broken making the PGP signature invalid

Whoops. Yeh I'm working on the encoding thing atm. Thank you for flagging! EDIT: I'm relying on the 'marked' npm package for markdown and it is handling the linkification of URLs, sometimes badly. Shall work on it.

Post by [deleted] » Mon, Jun 10, 2024, 1:36 PM UTC

Post by p-o » Mon, Jun 10, 2024, 1:36 PM UTC

michaelteter wrote: post #18

And are you prepared to respond to GDPR and other jurisdiction requirements of data collection and management?

Post by diggan » Mon, Jun 10, 2024, 1:38 PM UTC

padolsey wrote: post #27

diggan wrote: post #24

Earlier quoted context omitted.

Since marked doesn't do it for you, make sure you sanitize the user input (the text on the user profiles) before rendering it to visitors. Some libraries for doing that with good defaults: - https://github.com/cure53/DOMPurify - https://github.com/apostrophecms/sanitize-html - https://github.com/bevacqua/insane (right now your site looks vulnerable to XSS)

Yeh I'm sanitizing already thankfully. I've fixed the decoding issue, but I'm expecting some % of users to be borked for a whole other variety of quirky reasons.