4 ms·
>Posts of unknown authorship have a disclaimer at the top of the page. Problem is, the posts can contain <script> elements. So it's easy to just write a little
by jbarrs 3y ago
>Posts of unknown authorship have a disclaimer at the top of the page.
Problem is, the posts can contain <script> elements. So it's easy to just write a little JavaScript that removes the disclaimer at the top. See this hastily-made, immature example of mine:
https://joshcsimmons.com/post/H4sIABO8LmUC/3VT0W7aQBB85yu2QVUSiZik6QMilIqCKG6hSkVEFVV9OOw1vtS+c2/XGKN+fNeGAkpTy5Lv7J3ZmdlzE3yI1RrhKScGijVDWhImUaPht+CTpRiGHsx1mlpDLVA5x9aBjYBjTZBZ4tYOfwL1Go0mjAdf5dGEiS0gtNLlp5FVafOTctm5CvC+0XiUD3WF/w8dLDFQOSG8JKguLpxmRgMCidFhC7Q56vMOMgJlhH4p5LnDYwEUig4Uy/J5DxF3L1UkUPFhLEOQKJ3uoxCdmcTREs4gBiH6XvNagz8uYuaMuu32kxAGtGPzApu2q67tyVvyB/vr9Zvx7XT2q7O9n98s/K2W/Zf5YuLPh5vpYr5al7rI5sHNw+eZ8afjR1sOO/k1zoZ7rNyd0eCj03h7nVTvLvfBKAg11XLRgWLxLL5ttpsfQqZW6MFDHYQsBUNicGflCJSpm7CqdxhZCS6tTkpNv0RJ7CS5FF/VYX+LVXWWbJ6Ef1MrqhgTVDLGCFn400pdECsjfUVObkJ0mTJMMq9eBsRlgu/OImv4ivQWu5vNFaUqSc76o4Oy7m6IRS2bwaF8L/eDwfCFWbZgmTOEWK3ZKUaqcyAMcnFRQpSogg6nh0piTL1eO+v3KHA6435ogzxFw97ShqUXaUc8jHUSek4413hxeXeoYM3i4Pw/vxf8ltwRPiR2VdkfOe+51vO7Xnvf9Q96LLiepQMAAA== https://joshcsimmons.com/post/H4sIABO8LmUC/3VT0W7aQBB85yu2QV...
As it stands, this really isn't the most secure system. Something much more malicious could be injected into this!
- pjot 3y agoI was halfway expecting goatse
- latexr 3y agoShouldn’t it be “shat”? Either way, considering the submission we’re commenting on, the author of the blog may appreciate your humour.
- joshcsimmons 3y agoCorrect
- joshcsimmons 3y agoThis gave me a pretty good laugh. I have some sanitization and guards set up now. TBH I never really expected anyone to visit my blog.