Show HN: HN comments sidebar bookmarklet

Post by srimukh » Sat, Jun 24, 2023, 11:14 PM UTC

arkadiyt wrote: post #10

srimukh wrote: post #9

Earlier quoted context omitted.

Thank you for spotting this! I updated the code to escape some special characters. For people reading this, the parent comment is referring to this line[1] from a previous revision of the gist. [1]: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...

> For people reading this, the parent comment is referring to this line[1] from a previous revision of the gist. That was not the line, it was linking to this innerHTML call: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235... Also as a defense mitigation I don't think escaping is ever going to be effective, it would be better to create anchor elements directly. With your current approach I can still XSS…

Post by jfdi » Sun, Jun 25, 2023, 1:12 AM UTC

srimukh wrote: post #11

arkadiyt wrote: post #10

Earlier quoted context omitted.

> For people reading this, the parent comment is referring to this line[1] from a previous revision of the gist. That was not the line, it was linking to this innerHTML call: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235... Also as a defense mitigation I don't think escaping is ever going to be effective, it would be better to create anchor elements directly. With your current approach I can still XSS…

Thanks! For now, I added a warning under the gist. Not that this is an excuse, but I put this together in about 30 minutes using GPT-4 for fun without much consideration about robustness or security. I will maybe try to rewrite it when I find time.