2 ms·
How short we talking? Since there's multiple opportunities to inject code, it's possible to split out the payload across multiple fields: https://www.highsever
by koolba 3y ago
How short we talking?
Since there's multiple opportunities to inject code, it's possible to split out the payload across multiple fields: https://www.highseverity.com/2011/06/xss-in-confined-spaces.html https://www.highseverity.com/2011/06/xss-in-confined-spaces....
Ten characters per block is enough for:
<script>/*
*/eval(/*
*/'....'+/*
*/'....'+/*
*/'....'+/*
...
*/)/*
*/</script>
Best to escape everything at render time.
- mike_d 3y agoEverything is escaped server side before it is sent to the client. Shoot me an email and I will let you play with it after the HN traffic dies down.
- jamesnorden 3y ago[dead]