4 ms·
The [nodejs chat application](https://tryenlight.github.io/nodejs-chat https://tryenlight.github.io/nodejs-chat) should at least briefly run through the perils
by warent 9y ago
The [nodejs chat application](https://tryenlight.github.io/nodejs-chat https://tryenlight.github.io/nodejs-chat) should at least briefly run through the perils of XSS and ways to sanitize inputs. The chat app lets you inject arbitrary javascript/html/css which noobs may not consider at all.
Otherwise, great idea! Should help a lot of people
- deleted 9y ago[deleted]
- shamdasani 9y agoGood point - will add something on that soon. I by no means am a professional programmer, just a hobbyist sharing what I've learned.
- s4vi0r 9y agoWhy the `var`s everywhere in the example? They should really be `const`s
- deleted 9y ago[deleted]
- inimino 9y ago`var` still works everywhere, right?
- akvadrako 9y agoCurrent coding examples should be using the current best practice, which is const. If you want to support old browsers without compiling the JS, you are going to have a lot more issues than const/var and is not for beginners.
- rapind 9y agoIt's actually pretty easy to support older browser's without getting into the packaging mess if you don't need a modern framework. Learning webpack is a distraction from learning programming and would overwhelm a lot of the audience IMO.
- inimino 9y agoThe difference between `var` and `const` is irrelevant for beginners. `var` also happens to be the standard on deployed browsers and existing code, and every beginner should recognize it. It’s the least substantive thing you could pick to criticize about this code.
- ColinFCodeChef 9y agoThe gap between a professional and hobbyist is nowhere near as wide as one might think. Great idea, keep at it.
- warent 9y agoUnrelated: you joined >400 days ago and this appears to be your first post? Cool!
- inimino 9y agoTyping `<script>alert(0)</script>` into the chat box shows the injection hazard. In fact this is caused by using jQuery, which (inexcusably) runs embedded scripts when adding HTML to the page. The simplest solution to this entire class of bugs is simply to not use jQuery and use the better-designed DOM methods instead, which is probably a more modern approach anyway. Using innerHTML would solve the script injection, but you probably want to use innerText or createTextNode instead, since supporting HTML tags in a basic chat app seems more bug than feature. The server side should be safe already as it looks like there’s no persistence.
- foota 9y agoinnerHtml wouldn't eliminate xss vectors though, things like load=something could bypass this.
- inimino 9y agoYes, it's not completely safe. In a beginner tutorial, if you allow arbitrary HTML you should state that it shouldn't be done that way in a real app.
- shamdasani 9y agoThanks for the heads up. DOM methods are more clear and better. Will update the tutorial soon.
- hxtk 9y agoWould running inputs through a markdown engine on the server side fix this, assuming it didn't break some other design requirement?
- girvo 9y agoMarkdown allows HTML, though. You have to pick your engine or configuration carefully there, but the idea is sound.
- mncolinlee 9y agoThere once was a coder from Texas Who browsed websites on his Nexus. He used Dev Console Exploited a loophole And found a bevy of XSS.