Show HN: MapChat – A simple location based chat in 300 lines of code

Post by mapalertxssques » Fri, Jun 19, 2015, 3:09 PM UTC

jpallen wrote: post #47

This has serious XSS holes which need fixing! Here is a PR that should do the job (not tested): https://github.com/idoco/map-chat/pull/1

Post by Rivi » Fri, Jun 19, 2015, 3:12 PM UTC

golro wrote: post #11

very cool actually seeing all the other writers - a counter would actually be a great idea

Post by idoco » Fri, Jun 19, 2015, 3:27 PM UTC

krapp wrote: post #48

idoco wrote: post #28

Earlier quoted context omitted.

This is what I did for now msg.text = msg.text.replace('>','') .replace(' I will think of a more clever solution next week :)

Here is how mustache.js[0] does it: var entityMap = { "&": "&", " ": ">", '"': '"', "'": ''', "/": '/' }; function escapeHtml(string) { return String(string).replace(/[& "'\/]/g, function (s) { return entityMap[s]; }); } also document.createTextNode will tell the browser not to render the children as html, whereas appending a dom element and innerHTML will.[1] I'm just assuming that behavior is c…

Post by idoco » Fri, Jun 19, 2015, 3:41 PM UTC

jonnw wrote: post #32

great concept, just needs some more polish

Post by idoco » Fri, Jun 19, 2015, 3:43 PM UTC

jpallen wrote: post #56

jpallen wrote: post #47

This has serious XSS holes which need fixing! Here is a PR that should do the job (not tested): https://github.com/idoco/map-chat/pull/1

Looks like it's all fixed now :)