Show HN: MapChat – A simple location based chat in 300 lines of code • Hacker News Board

Re: Show HN: MapChat – A simple location based chat in 300 lines of code

#41

Post by clemlais » Fri, Jun 19, 2015, 2:52 PM UTC

MrBra wrote: post #39

What's the name of the russian sounding song that someone injected? I've been searching it for ages!

Loituma - Ievan Polkka

Re: Show HN: MapChat – A simple location based chat in 300 lines of code

#42

Post by MrBra » Fri, Jun 19, 2015, 2:53 PM UTC

clemlais wrote: post #41

MrBra wrote: post #39

What's the name of the russian sounding song that someone injected? I've been searching it for ages!

Loituma - Ievan Polkka

Thanks! I want to say I love you but I will only say that I wanted to say it :P

Re: Show HN: MapChat – A simple location based chat in 300 lines of code

#43

Post by sudhirmishra » Fri, Jun 19, 2015, 2:53 PM UTC

This is super, will fork it into a private chat with bunch of my friends.

Re: Show HN: MapChat – A simple location based chat in 300 lines of code

#44

Post by jonnw » Fri, Jun 19, 2015, 2:53 PM UTC

botw wrote: post #40

Rygu wrote: post #31

Earlier quoted context omitted.

I see an iframe on the page. Right now.

suddenly someone injected www.leekspin.com while I'm viewing the map.

that made me laugh

Re: Show HN: MapChat – A simple location based chat in 300 lines of code

#45

Post by striking » Fri, Jun 19, 2015, 2:54 PM UTC

MrBra wrote: post #39

What's the name of the russian sounding song that someone injected? I've been searching it for ages!

You're looking for https://en.wikipedia.org/wiki/Loituma_Girl

Re: Show HN: MapChat – A simple location based chat in 300 lines of code

#46

Post by [deleted] » Fri, Jun 19, 2015, 2:56 PM UTC

sudhirmishra wrote: post #43

This is super, will fork it into a private chat with bunch of my friends.

[deleted]

Re: Show HN: MapChat – A simple location based chat in 300 lines of code

#47

Post by jpallen » Fri, Jun 19, 2015, 2:57 PM UTC

This has serious XSS holes which need fixing! Here is a PR that should do the job (not tested): https://github.com/idoco/map-chat/pull/1

Re: Show HN: MapChat – A simple location based chat in 300 lines of code

#48

Post by krapp » Fri, Jun 19, 2015, 2:58 PM UTC

idoco wrote: post #28

idoco wrote: post #26

Earlier quoted context omitted.

I think it is now somewhat disabled. you just need to refresh the page.

This is what I did for now msg.text = msg.text.replace('>','') .replace(' I will think of a more clever solution next week :)

Here is how mustache.js[0] does it:

    var entityMap = {
        "&": "&amp;",
        "": "&gt;",
        '"': '&quot;',
        "'": '&#39;',
        "/": '&#x2F;'
     };

      function escapeHtml(string) {
        return String(string).replace(/[&"'\/]/g, function (s) {
          return entityMap[s];
        });
      }

also document.createTextNode will tell the browser not to render the children as html, whereas appending a dom element and innerHTML will.[1] I'm just assuming that behavior is correct in all browsers though.

[0]https://github.com/janl/mustache.js/blob/master/mustache.js#...

[1]https://jsfiddle.net/1dsygwoj/

Re: Show HN: MapChat – A simple location based chat in 300 lines of code

#49

Post by pskocik » Fri, Jun 19, 2015, 3:05 PM UTC

idoco wrote: post #28

idoco wrote: post #26

Earlier quoted context omitted.

I think it is now somewhat disabled. you just need to refresh the page.

This is what I did for now msg.text = msg.text.replace('>','') .replace(' I will think of a more clever solution next week :)

That's super easy to get around. It only replaces the first occurrence of each.

Re: Show HN: MapChat – A simple location based chat in 300 lines of code

#50

Post by Rivi » Fri, Jun 19, 2015, 3:08 PM UTC

ohitsdom wrote: post #9

Very nice! Lot of people having fun in there right now, which is a clear sign you did something right.

So much fun!