4 ms·

Hey HN staff, there's a bug here: body shows fine, but the title renders as "A story about <input>"

• recursive 11y ago
  I'm seeing this as well. The served html says <title>A story about &amp;lt;input&amp;gt; | Hacker News</title> It looks like it got double encoded.
  • nathancahill 11y ago
    Funny, my HTML based HN app on iOS actually rendered[0] an input field in the title. Disappeared after a second. No one submit titles with <script>alert()</script> please! It looks like the title in the API is encoded correctly[1]. [0] http://i.imgur.com/CDnwDZJ.jpg http://i.imgur.com/CDnwDZJ.jpg [1] https://hacker-news.firebaseio.com/v0/item/10433793.json?print=pretty https://hacker-news.firebaseio.com/v0/item/10433793.json?pri...
    • natzim 11y ago
      Oh boy...
    • deleted 11y ago
      [deleted]
    • szatkus 11y ago
      CommaFeed has similar problem. http://imgur.com/Bijmmuh http://imgur.com/Bijmmuh
    • scintill76 11y ago
      The API is returning "title" : "A story about <input>" for me. I don't consider that correct encoding, as "<" is not a special escape sequence in JSON, and expecting API consumers to either blindly trust you did their escaping for them, or HTML-decode JSON strings to use in another context, is silly. It is probably another symptom of something HTML-escaping the title when it shouldn't be.
      • nathancahill 11y ago
        Yes, you're right.
    • vito 11y ago
      Same issue on Android: http://i.imgur.com/FKPvJsq.png http://i.imgur.com/FKPvJsq.png Time to avoid /newest.