Comment by Breefield | Hacker News Reader

Top New Best Ask Show Jobs

Comment by Breefield | Hacker News Reader

Careful, this code runs eval() on all spreadsheet fields. Someone can "collaboratively" steal your jsfiddle.net cookies.

The code runs on the fiddle.jshell.net domain.

that's good :) did not realize

one could use a function constructor instead of eval to try to mitigate XSS.

Yeah that was fun until I got an alert box in my face.

Reply on news.ycombinator.com