Show HN: Roomchat – No signup instant custom chat rooms • Hacker News Board

Show HN: Roomchat – No signup instant custom chat rooms

#1

Post by nerdburn » Wed, Aug 05, 2015, 8:36 PM UTC

Show HN: Roomchat – No signup instant custom chat rooms
roomchat.co

Re: Show HN: Roomchat – No signup instant custom chat rooms

#2

Post by nerdburn » Wed, Aug 05, 2015, 8:49 PM UTC

We created this in Meteor.js, pretty fun. Great for short term chat rooms that don't need a sign up. Would love feedback!

Re: Show HN: Roomchat – No signup instant custom chat rooms

#3

Post by timebomb » Wed, Aug 05, 2015, 11:08 PM UTC

Cool! Looks like HTML injection isn't blocked whatsoever. With chat messages being loaded as people enter, it could lead to someone exploiting everyone that enters your site.

Re: Show HN: Roomchat – No signup instant custom chat rooms

#4

Post by nautical » Wed, Aug 05, 2015, 11:19 PM UTC

Please fix it :

Re: Show HN: Roomchat – No signup instant custom chat rooms

#5

Post by adriaanwm » Wed, Aug 05, 2015, 11:41 PM UTC

thanks guys, fixing it now

Re: Show HN: Roomchat – No signup instant custom chat rooms

#6

Post by nerdburn » Wed, Aug 05, 2015, 11:43 PM UTC

timebomb wrote: post #3

Cool! Looks like HTML injection isn't blocked whatsoever. With chat messages being loaded as people enter, it could lead to someone exploiting everyone that enters your site.

Ha, good catch! It's just a toy at this point, but we'll fix that asap.

Re: Show HN: Roomchat – No signup instant custom chat rooms

#7

Post by adriaanwm » Wed, Aug 05, 2015, 11:50 PM UTC

fixed

Re: Show HN: Roomchat – No signup instant custom chat rooms

#8

Post by mike-cardwell » Sat, Aug 08, 2015, 5:21 PM UTC

XSS by writing the message:

  mg src="#" onerror="alert(1)">

Just stripping out tags doesn't work. Stripping out the script tags there simply ends up creating another new tag. You need to understand and implement proper escaping.

Re: Show HN: Roomchat – No signup instant custom chat rooms

#9

Post by nautical » Sun, Aug 09, 2015, 7:27 PM UTC

People ... It still has XSS issues ..