Hacker News Reader

Comment by koolba | Hacker News Reader

That’s neat. What’s the total volume per day? Are the passwords themselves being escaped in the final UI rendering? Otherwise you’d have an XSS for a password like “<script>/* code */<script>".

EDIT: Unless it's happening on the server side where it's being saved, I don't think they're being escaped:

    col1.innerHTML = '<span class="fi fi-' + msg.cc + '" title="' + msg.cc + '"></span> ' + msg.src;
    col2.innerHTML = msg.proto;
    col3.innerHTML = '<code>' + msg.u + '</code>';
    col4.innerHTML = '<code>' + msg.p + '</code>';

View on HN

Sorry, but this is not the way. It's like saying, "but I am escaping my inputs on sql with my function"... instead of doing the right thing.

The equivalent code is really not that hard:

    const span = document.createElement('span')
    span.setAttribute('class', 'fi fi'+msg.cc)
    span.setAttribute('title', msg.cc)

    col1.appendChild(span)
    col1.appendChild(document.createTextNode(msg.src))

    col2.textContent = msg.proto

    let code = document.createElement('code')

    code.textContent = msg.u
    col3.appendChild(code)

    code = code.cloneNode(true)
    code.textContent = msg.p
    col4.appendChild(code)

or something in these lines.. you get the idea

It is escaped server side. Anything long enough to be a useful payload is trimmed.

How short we talking?

Since there's multiple opportunities to inject code, it's possible to split out the payload across multiple fields: https://www.highseverity.com/2011/06/xss-in-confined-spaces....

Ten characters per block is enough for:

    <script>/*
    */eval(/*
    */'....'+/*
    */'....'+/*
    */'....'+/*
    ...
    */)/*
    */</script>

Best to escape everything at render time.

Everything is escaped server side before it is sent to the client. Shoot me an email and I will let you play with it after the HN traffic dies down.

As the other comment said, just write proper code instead of going "oh but it's escaped and size-limited."

JS has sane APIs where no string is "dangerous," use them.

Reply on news.ycombinator.com