3 ms·

Whoops. Yeh I'm working on the encoding thing atm. Thank you for flagging! EDIT: I'm relying on the 'marked' npm package for markdown and it is handling the lin

Whoops. Yeh I'm working on the encoding thing atm. Thank you for flagging! EDIT: I'm relying on the 'marked' npm package for markdown and it is handling the linkification of URLs, sometimes badly. Shall work on it.

diggan 2y ago
Since marked doesn't do it for you, make sure you sanitize the user input (the text on the user profiles) before rendering it to visitors. Some libraries for doing that with good defaults: - https://github.com/cure53/DOMPurify https://github.com/cure53/DOMPurify - https://github.com/apostrophecms/sanitize-html https://github.com/apostrophecms/sanitize-html - https://github.com/bevacqua/insane https://github.com/bevacqua/insane (right now your site looks vulnerable to XSS)
- padolsey 2y ago
  Yeh I'm sanitizing already thankfully. I've fixed the decoding issue, but I'm expecting some % of users to be borked for a whole other variety of quirky reasons.
  - diggan 2y ago
    Nice :) Ah, I bet you discovered that subdomains aren't case-sensitive while HN usernames are case-sensitive, didn't you? :)
    - Edd1CC 2y ago
      HN usernames aren't case-sensitive: > That username conflicts with an existing one. Names are case-insensitive. Please choose another.
      - Retr0id 2y ago
        They're case-sensitive for the purpose of scraping a profile page. https://news.ycombinator.com/user?id=Retr0id https://news.ycombinator.com/user?id=Retr0id - 200 https://news.ycombinator.com/user?id=retr0id https://news.ycombinator.com/user?id=retr0id - 404 (Edit: 200 now?)
        michaelmior 2y ago
        That second one doesn't give me a 404 but correctly shows your profile.
        Retr0id 2y ago
        Weird, it also works for me now, I could've sworn it didn't work before. The firebase API on the other hand remains case-sensitive: https://hacker-news.firebaseio.com/v0/user/Retr0id.json https://hacker-news.firebaseio.com/v0/user/Retr0id.json => full response https://hacker-news.firebaseio.com/v0/user/retr0id.json https://hacker-news.firebaseio.com/v0/user/retr0id.json => null
        diggan 2y ago
        I think maybe you're thinking about the "threads" list/page: - https://news.ycombinator.com/threads?id=Retr0id https://news.ycombinator.com/threads?id=Retr0id - Works - https://news.ycombinator.com/threads?id=retr0id https://news.ycombinator.com/threads?id=retr0id - Doesn't work Which somehow I guess the API is using.
        Retr0id 2y ago
        Possibly, although according to this[0] the main profile URL used to be case-sensitive too. It must've changed recently, but I have no idea when. [0] https://github.com/keybase/keybase-issues/issues/939 https://github.com/keybase/keybase-issues/issues/939
tracker1 2y ago
maybe wrap it in three backticks on a line before and after?
- tracker1 2y ago
  For example... Markdown Content ... ``` -- BEGIN PGP... https://news.ycombinator.com/user?id=yourname yourname.at.hn --- signature ```

diggan 2y ago

Since marked doesn't do it for you, make sure you sanitize the user input (the text on the user profiles) before rendering it to visitors. Some libraries for doing that with good defaults: - https://github.com/cure53/DOMPurify https://github.com/cure53/DOMPurify - https://github.com/apostrophecms/sanitize-html https://github.com/apostrophecms/sanitize-html - https://github.com/bevacqua/insane https://github.com/bevacqua/insane (right now your site looks vulnerable to XSS)

padolsey 2y ago
Yeh I'm sanitizing already thankfully. I've fixed the decoding issue, but I'm expecting some % of users to be borked for a whole other variety of quirky reasons.
- diggan 2y ago
  Nice :) Ah, I bet you discovered that subdomains aren't case-sensitive while HN usernames are case-sensitive, didn't you? :)
  - Edd1CC 2y ago
    HN usernames aren't case-sensitive: > That username conflicts with an existing one. Names are case-insensitive. Please choose another.
    - Retr0id 2y ago
      They're case-sensitive for the purpose of scraping a profile page. https://news.ycombinator.com/user?id=Retr0id https://news.ycombinator.com/user?id=Retr0id - 200 https://news.ycombinator.com/user?id=retr0id https://news.ycombinator.com/user?id=retr0id - 404 (Edit: 200 now?)
      - michaelmior 2y ago
        That second one doesn't give me a 404 but correctly shows your profile.
        Retr0id 2y ago
        Weird, it also works for me now, I could've sworn it didn't work before. The firebase API on the other hand remains case-sensitive: https://hacker-news.firebaseio.com/v0/user/Retr0id.json https://hacker-news.firebaseio.com/v0/user/Retr0id.json => full response https://hacker-news.firebaseio.com/v0/user/retr0id.json https://hacker-news.firebaseio.com/v0/user/retr0id.json => null
        diggan 2y ago
        I think maybe you're thinking about the "threads" list/page: - https://news.ycombinator.com/threads?id=Retr0id https://news.ycombinator.com/threads?id=Retr0id - Works - https://news.ycombinator.com/threads?id=retr0id https://news.ycombinator.com/threads?id=retr0id - Doesn't work Which somehow I guess the API is using.
        Retr0id 2y ago
        Possibly, although according to this[0] the main profile URL used to be case-sensitive too. It must've changed recently, but I have no idea when. [0] https://github.com/keybase/keybase-issues/issues/939 https://github.com/keybase/keybase-issues/issues/939

tracker1 2y ago

maybe wrap it in three backticks on a line before and after?

tracker1 2y ago
For example... Markdown Content ... ``` -- BEGIN PGP... https://news.ycombinator.com/user?id=yourname yourname.at.hn --- signature ```