3 ms·
The extension does two things: - It sends sha1 of the url to the data server to check the numebr of comments, but doesn't pull the comments. - It renders an <if
by comntr 7y ago
The extension does two things:
- It sends sha1 of the url to the data server to check the numebr of comments, but doesn't pull the comments.
- It renders an <iframe src="comntr.github.io#foobar.com"> to show the comments.
Thus the extension has very little code and doesn't need much updates.
- nextlevelwizard 7y agoSo answer is yes. The database does not sanitize user input and the extension just renders the tags as actual HTML. That doesn't seem super safe. I mean just check the example page from the github. It already has embedded Youtube videos and gifs.
- comntr 7y agoAh, right, I forgot to add basic html escaping!