WorldChat.io: Chat with realtime translation

Re:WorldChat.io: Chat with realtime translation by octatone2 on Tuesday May 21, 2013 @02:45PM (#5745838)

{{{message}}} in handlebars means that if someone one gets around your server-side sanitization your client side is wide open to XSS ...

also, rate limit the users, this is thing is managing to crash chrome!

[ Parent | on HN ]

Re:WorldChat.io: Chat with realtime translation by anonfunction on Tuesday May 21, 2013 @02:47PM (#5745856)

Working on it, any tips to keep entity encoding in handlebars without the triple stash?

[ Parent | on HN ]

Re:WorldChat.io: Chat with realtime translation by octatone2 on Tuesday May 21, 2013 @02:56PM (#5745899)

Don't encode entities on the server side if you are using handlebars, it will do that for you (that's the point of using {{}} it will make all user input "safe").

[ Parent | on HN ]

Re:WorldChat.io: Chat with realtime translation by Sephr on Tuesday May 21, 2013 @04:32PM (#5746630)

Don't encode entities, just use the DOM (append text nodes).

[ Parent | on HN ]