21–30 of 31 posts
Earlier quoted context omitted.
Should still be sanitizing user input, there's no reason to be passing the message as an html variable in handlebars {{{message}}} :/ You trust your server-side sanitization that much?
Do you trust the client side at all?
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->">'>alert(String.fromCharCode(88,83,83)){{{message}}} in handlebars means that if someone one gets around your server-side sanitization your client side is wide open to XSS ... also, rate limit the users, this is thing is managing to crash chrome!
Working on it, any tips to keep entity encoding in handlebars without the triple stash?
Or you could even follow a similar idea to Omegle by pairing two people together but make it so it pairs two people who speak in different languages?
I built a proof of concept for something like this for someone quite a while ago... what he had that you desperately need is channels. This is entirely useless with any amount of people (particularly when spammers can't be controlled, which is just how the net is). Excellent idea, but it needs some concept of segmentation to be useful.
ahem http://i.imgur.com/3LnvN52.png?1
I wrote a very similar chat application using google translation, tech demo here: http://speak.ly