Hacker News Reader

Hacker News

Comment by est | Hacker News Reader

Full thread

est

omg the comments section are directly scraped from this very page.

View on HN

<span style="font-size: 300px;"><marquee>hello</marquee></span>

Huh, there is no alert, but the script node is there in the DOM. I'm confused.

Probably because it gets dynamically added to the DOM tree and AFAIK stuff like that does not get executed.

Check your devtools: the inline script is violating the CSP, so your browser is saving you at the last line of defense.

HN: be careful with doing things like this, technically speaking this could be considered illegal.

technically speaking the moon could be made of cheese

I'm still holding a faint hope for that

I'd like to see a xkcd -"What if the moon was made of chees?", and with sections for different types of cheese.

I guess rot would be no problem, but the surface would probably liquefy during the day, and freeze at night, turning into a cheese sea (or maybe an under-crust sea beneath frozen-cheese ice crust?) affected by earth-induced tides, and possibly internal tidal heating which liquefies the inside of the moon too.

How would this be illegal? I get why something like "Bobby Tables" would be, but there is no harm or bad intention visible here.

The lack of sanitizers has been illegal for more than a year in most countries. /s

Technically copying comments could be considered illegal since you can argue no explicit or implied copyright license was given for this usage.

Hah. Someone got it working, I see.

This is how you do the script thing:

:^)

Edit: meh, stupid CSP…

Seems like their Content Security Policy should block those from executing as "unsafe-inline" is not allowed.

(Yep it worked)

These comments gave me an extreme nostalgic feeling. It's like it's early 2000 again when everyone that could operate a keyboard would try to make his own dynamic site with PHP (read as: copy&paste some "guestbook" code from a tutorial). Oh, the memories and fun we had with those ...

Hehe, my first open source “project” was a comment box written in PHP, circa 2004 at the age of 13… It used a single txt file for storing the comments, so I’m afraid it wasn’t webscale™, but I didn’t know better at the time :]

Don't sell yourself short, it was probably more efficient than the wobbling tower of npm packages and ajax requests most comment systems are made of today.

It seems they are fetching the comments from the Hacker News Algolia index. Curiously they seem to un-sanitize the comment content before inserting it to the page DOM as one of the sibling comments proves.

The Algolia index contains the comments encoded as HTML entities, so they should be safe to insert as is, but seems like the page is first converting it back to HTML, which causes the script and span tags to render as HTML instead of text like here on HN.

Algolia has some rough edges. I've tried to work with them on a couple of occasions but it's a bit of a harder problem than meets the eye because apparently Algolia gets a feed directly from HN with the original comment contents as they were typed into the text box rather than the rendered HTML version of the comment, which ironically would probably be easier to deal with. I have a particular comment discussing HTML injection that I've worked with them twice to stop rendering as actual script tags, which means, yes, it actually regressed once.

Reply on news.ycombinator.com