News for hackers. Stuff that matters.
Re:Show HN: A Firefox extension to leave comments on any URL by comntr on Friday June 28, 2019 @12:41AM (#20301518)
The extension does two things: - It sends sha1 of the url to the data server to check the numebr of comments, but doesn't pull the comments. - It renders an <iframe src="comntr.github.io#foobar.com"> to show the comments. Thus the extension has very little code and doesn't need much updates.
Re:Show HN: A Firefox extension to leave comments on any URL by nextlevelwizard on Friday June 28, 2019 @01:44AM (#20301786)
So answer is yes. The database does not sanitize user input and the extension just renders the tags as actual HTML. That doesn't seem super safe. I mean just check the example page from the github. It already has embedded Youtube videos and gifs.
Re:Show HN: A Firefox extension to leave comments on any URL by comntr on Friday June 28, 2019 @02:17AM (#20301921)
Ah, right, I forgot to add basic html escaping!