5 ms·
Show HN: Roomchat – No signup instant custom chat rooms
- nerdburn 11y agoWe created this in Meteor.js, pretty fun. Great for short term chat rooms that don't need a sign up. Would love feedback!
- timebomb 11y agoCool! Looks like HTML injection isn't blocked whatsoever. With chat messages being loaded as people enter, it could lead to someone exploiting everyone that enters your site.
- nerdburn 11y agoHa, good catch! It's just a toy at this point, but we'll fix that asap.
- nautical 11y agoPlease fix it : <IMG SRC=# onmouseover="alert('xxs')">
- adriaanwm 11y agothanks guys, fixing it now
- adriaanwm 11y agofixed
- mike-cardwell 11y agoXSS by writing the message: <i<script></script>mg src="#" onerror="alert(1)"> Just stripping out tags doesn't work. Stripping out the script tags there simply ends up creating another new tag. You need to understand and implement proper escaping.
- nautical 11y agoPeople ... It still has XSS issues ..