3 ms·
The example page seems to render HTML (and I bet JS) from comments, while hilarious does same thing happen in the extension as well?
by nextlevelwizard 7y ago
The example page seems to render HTML (and I bet JS) from comments, while hilarious does same thing happen in the extension as well?
- comntr 7y agoThe extension does two things: - It sends sha1 of the url to the data server to check the numebr of comments, but doesn't pull the comments. - It renders an <iframe src="comntr.github.io#foobar.com"> to show the comments. Thus the extension has very little code and doesn't need much updates.
- nextlevelwizard 7y agoSo answer is yes. The database does not sanitize user input and the extension just renders the tags as actual HTML. That doesn't seem super safe. I mean just check the example page from the github. It already has embedded Youtube videos and gifs.
- comntr 7y agoAh, right, I forgot to add basic html escaping!