News for hackers. Stuff that matters.

A comment on A minimalistic site to vent and see others doing the same in realtime. Parent comment

Re:A minimalistic site to vent and see others doing the same... by llarsson on Wednesday January 27, 2021 @05:44AM (#25926577)
Holy hell, OP.

What prevents me from just calling "postMessage" directly myself, which does nothing to prevent the "sanitation" that the replace function call there is supposed to do?

Please sanitize messages on the server instead.

[ Parent | on HN ]
Re:A minimalistic site to vent and see others doing the same... by Mapsmithy on Wednesday January 27, 2021 @11:06AM (#25929930)
The fact that it's also called when its added to the stack for display. OP should definitely still sanitize on the server, but it's not as bad as it sounds at first glance.

As an exercise I'd love it someone actually posted a payload to exploit that regex.

[ Parent | on HN ]