5 ms·
I created an ephemeral group chat app for strangers
- deleted 3y ago[deleted]
- Banditoz 3y agoNeat little project, but you can pass HTML tags directly into the chat! <script> doesn't seem to run, but <img> can load from external sites. Be careful!
- tejitopia 3y agoHow can I fix this? this is my first full stack app I've built and it's nice seeing users interact with the site
- Egdhifh 3y agohttps://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc... Edit: this focuses on script tags and other means to inject code, but most defenses also work for other injected tags
- tejitopia 3y agothank you for this resource :) going to look into that. first time figuring out opsec !
- bagels 3y agoSite is susceptible to some kind of css attack. Too bad.
- deleted 3y ago[deleted]
- tejitopia 3y agoHow can I fix this?
- freetonik 3y agoYou can try escaping HTML submitted from the form. Or even simply detecting the presence of any HTML tag and rejecting such submissiobs with a friendly error message.
- tejitopia 3y agoah yes! i will do this in the next version. someone recomended leaving some of the xss elements like the image and video function with the old school chat vibes but I'm not sure what to do lmaooo
- KETHERCORTEX 3y agoOld school chats and forums dealt with that with special limited markup language for formatting and embedding images or other special elements like youtube videos. Everything outside the limited markup options was treated as text with the replacement of < and > to HTML entities < and > meant to display HTML special characters in text. It was called BBcode, if I recall correctly. It looked something like that: [b]bold[/b] [i]italic[/i] [img]example.com/image.jpg[/img] [youtube]youtube.com/watch?v=someVideo[/youtube]
- MzHN 3y agoI like to use a small utility function like this and pass user input through it. function asTextContent(input) { const tempElement = document.createElement('span'); tempElement.textContent = input; return tempElement.innerHTML; } It will let the browser handle the escaping.
- pringk02 3y agoReally wanted to enjoy this, but it seemed like the room size of 5 was way too small. People would pop in and out endlessly hoping for some bustle but none seemed to be able to build. What chat I did get really recreated the 14 year old edgelords in chatrooms experience though. Lots of porn gif spamming
- tejitopia 3y agoPerhaps I might increase room limit to 10 users? I'm trying to replicate the feeling of a hostel commonroom
- jjbinx007 3y ago2 observations: I couldn't figure out what my username was, I had to ask in the chat. It's possible to embed recursive iframes, so I can see that being exploited for bad things. Otherwise I like the idea. People in the chat were nice, but I can't help but think that soon chat rooms will be full of chatGPT bots and nobody will be any the wiser!
- tejitopia 3y agoThank you for the feedback! So far from users I've heard they want: 1) username visibility fix making sure all colors are visible 2) removal of xss 3) ability to see your own username (its just "you" rn) 4) dark mode open to any and all suggestions :) my first full stack app. its cool seeing it being used
- isoprophlex 3y agoDon't show people entering and leaving. It clutters the chat, and you don't need to be notified of people leaving as the ephemerality of this is pretty explicit. Larger group sizes to maintain coherence. sanitize your inputs because this is REALLY NSFW now
- tejitopia 3y agoThis is a great comment. Will be implementing this in the next push.
- isoprophlex 3y agoGood luck polishing things up! I had a normal (non goatse'd) session the first try. It really recaptured the early internet vibe for me... loving your idea.
- nusl 3y agoBeyond broken and unsuitable for public release. Take it down and fix it.
- tejitopia 3y agoWow. It was working great at the start before people started spamming nsfw content and injecting html and css into the page. Will be taking down the site in the morning and working on version 2. I guess from this I can say there’s some demand?
- beeboobaa 3y agoEasy fix: In your script.js in the appendMessage function do this: const chatMessage = document.createElement("div"); chatMessage.classList.add("chat-message"); chatMessage.innerHTML = `<span class="username" style="color: ${color};">${username}:</span> `; const userMessage = document.createElement('span'); span.innerText = message; chatMessage.appendChild(userMessage); chatContainer.appendChild(chatMessage); chatContainer.scrollTop = chatContainer.scrollHeight;
- bossyTeacher 3y agoI love how people here actually check the source code of a website. So HN
- nusl 3y agoIt's unfortunate, though anything you make online now will be abused readily and should thus be hardened. By leaving it in the state it was, regular users were endangered.
- someuser54541 3y agoSome user was able to open a browser modal with a custom message in everyones browser. Any ideas how they did that?
- bean-weevil 3y agohttps://en.wikipedia.org/wiki/Cross-site_scripting https://en.wikipedia.org/wiki/Cross-site_scripting The author of the site was naughty and didn't do any sanitization :) They said they've fixed it in another comment, though.
- _l219 3y ago<iframe src="" height=0 width=0 onload="alert(1)" />
- bossyTeacher 3y agowhat about it? you can't insert an iframe in the chat, I tried ;)
- _lvbh 3y agoIt was fixed
- mariansam 3y agoLots of awful porn gifs spam, even from my account because there are security issues that allowed other group members to send messages with my nick
- flanked-evergl 3y agoYou should disable gif/image rendering by default and make it opt-in, this is basically a link to porn right now and HN should take it down.
- gtroja 3y agoI was having fun, but the message feed started bugging out :( (a lot of messages of broken images and 'meow' text)
- tejitopia 3y agoOk I think I fixed the XCC issue !
- bossyTeacher 3y agoNo more fun :)
- bossyTeacher 3y agoSomeone flagged your submission