Hacker News Reader

Comment by grepular | Hacker News Reader

There seems to be some weird encoding issues and failure to convert URLs to links properly, for my profile - https://mike-cardwell.at.hn/ - Also, some of the indenting and white space is broken making the PGP signature invalid

View on HN

Whoops. Yeh I'm working on the encoding thing atm. Thank you for flagging! EDIT: I'm relying on the 'marked' npm package for markdown and it is handling the linkification of URLs, sometimes badly. Shall work on it.

Since marked doesn't do it for you, make sure you sanitize the user input (the text on the user profiles) before rendering it to visitors.

Some libraries for doing that with good defaults:

- https://github.com/cure53/DOMPurify

- https://github.com/apostrophecms/sanitize-html

- https://github.com/bevacqua/insane

(right now your site looks vulnerable to XSS)

Yeh I'm sanitizing already thankfully. I've fixed the decoding issue, but I'm expecting some % of users to be borked for a whole other variety of quirky reasons.

Nice :)

Ah, I bet you discovered that subdomains aren't case-sensitive while HN usernames are case-sensitive, didn't you? :)

HN usernames aren't case-sensitive:

> That username conflicts with an existing one. Names are case-insensitive. Please choose another.

They're case-sensitive for the purpose of scraping a profile page.

https://news.ycombinator.com/user?id=Retr0id - 200

https://news.ycombinator.com/user?id=retr0id - 404 (Edit: 200 now?)

That second one doesn't give me a 404 but correctly shows your profile.

Weird, it also works for me now, I could've sworn it didn't work before.

The firebase API on the other hand remains case-sensitive:

https://hacker-news.firebaseio.com/v0/user/Retr0id.json => full response

https://hacker-news.firebaseio.com/v0/user/retr0id.json => null

I think maybe you're thinking about the "threads" list/page:

- https://news.ycombinator.com/threads?id=Retr0id - Works

- https://news.ycombinator.com/threads?id=retr0id - Doesn't work

Which somehow I guess the API is using.

Possibly, although according to this[0] the main profile URL used to be case-sensitive too. It must've changed recently, but I have no idea when.

[0] https://github.com/keybase/keybase-issues/issues/939

maybe wrap it in three backticks on a line before and after?

For example...

    Markdown Content
    ...
    ```
    -- BEGIN PGP...
    https://news.ycombinator.com/user?id=yourname
    yourname.at.hn
    --- signature
    ```

The link to your public key is missing the colon after the https

Good catch. Thanks

Reply on news.ycombinator.com