5 ms·
omg the comments section are directly scraped from this very page.
by est 5y ago
omg the comments section are directly scraped from this very page.
- veeti 5y ago<script>alert(1+1);</script> <span style="font-size: 300px;"><marquee>hello</marquee></span>
- deleted 5y ago[deleted]
- kaoD 5y agoHuh, there is no alert, but the script node is there in the DOM. I'm confused.
- uzakov 5y agoHN: be careful with doing things like this, technically speaking this could be considered illegal.
- Chris2048 5y agotechnically speaking the moon could be made of cheese
- danmur 5y agoI'm still holding a faint hope for that
- Chris2048 5y agoI'd like to see a xkcd -"What if the moon was made of chees?", and with sections for different types of cheese. I guess rot would be no problem, but the surface would probably liquefy during the day, and freeze at night, turning into a cheese sea (or maybe an under-crust sea beneath frozen-cheese ice crust?) affected by earth-induced tides, and possibly internal tidal heating which liquefies the inside of the moon too.
- numlock86 5y agoHow would this be illegal? I get why something like "Bobby Tables" would be, but there is no harm or bad intention visible here.
- chupasaurus 5y agoThe lack of sanitizers has been illegal for more than a year in most countries. /s
- marcinzm 5y agoTechnically copying comments could be considered illegal since you can argue no explicit or implied copyright license was given for this usage.
- InvertedRhodium 5y agoHah. Someone got it working, I see.
- layoutIfNeeded 5y agoThis is how you do the script thing: <img src="kitten.jpg" onerror="alert('meow!')"> :^) Edit: meh, stupid CSP…
- maybevain 5y agoSeems like their Content Security Policy should block those from executing as "unsafe-inline" is not allowed.
- supergirl 5y ago<span style="font-size: 300px;"><marquee>fail</marquee></span>
- layoutIfNeeded 5y ago<!--<div style="position: fixed; top: 0; left: 0; right: 0; bottom: 0; background: red;">Fix your website</div>--> (Yep it worked)
- numlock86 5y agoThese comments gave me an extreme nostalgic feeling. It's like it's early 2000 again when everyone that could operate a keyboard would try to make his own dynamic site with PHP (read as: copy&paste some "guestbook" code from a tutorial). Oh, the memories and fun we had with those ...
- layoutIfNeeded 5y agoHehe, my first open source “project” was a comment box written in PHP, circa 2004 at the age of 13… It used a single txt file for storing the comments, so I’m afraid it wasn’t webscale™, but I didn’t know better at the time :]
- ehnto 5y agoDon't sell yourself short, it was probably more efficient than the wobbling tower of npm packages and ajax requests most comment systems are made of today.
- deleted 5y ago[deleted]
- maybevain 5y agoIt seems they are fetching the comments from the Hacker News Algolia index. Curiously they seem to un-sanitize the comment content before inserting it to the page DOM as one of the sibling comments proves. The Algolia index contains the comments encoded as HTML entities, so they should be safe to insert as is, but seems like the page is first converting it back to HTML, which causes the script and span tags to render as HTML instead of text like here on HN.
- jerf 5y agoAlgolia has some rough edges. I've tried to work with them on a couple of occasions but it's a bit of a harder problem than meets the eye because apparently Algolia gets a feed directly from HN with the original comment contents as they were typed into the text box rather than the rendered HTML version of the comment, which ironically would probably be easier to deal with. I have a particular comment discussing HTML injection that I've worked with them twice to stop rendering as actual script tags, which means, yes, it actually regressed once.