Chat with your friends!

General Showcase
72

Can I help with the formatting and css?
Just make the shapes more consistent, better on mobile devices, and some tiny tweaks

1 Like
73

I’m really not working on that anymore.

2 Likes
74

Pls can i be admin i want to help make the chat a better place

1 Like
75

If you get admin, please unban Matt.

1 Like
76

Well, everyone was warned to not try XSS, even for testing, or they would get banned by the filters.

Am I correct @MattDESTROYER?

2 Likes
77

I might have succeeded :grimacing: … lol

(and then got myself banned again trying to push the limits lol)

I recommend trying some RegEx like this: <\w+.*( *on\w+ *= *('|").*('|"))+.*?.*> (case insensitive as well, gmi is what I would do) to be more successfull with catching XSS that exploits on attributes. Here’s a demo of that RegEx…

3 Likes
78

Hm. What if, and hear me out, I distribute an CSS injector to everyone, so then you can’t ban them all? :stuck_out_tongue:

1 Like
79

Try using DOMPurify or something similar rather than playing whack-a-mole but with exploits and XSS attacks.

2 Likes
80

or instead, just replace the following:

< <!----> &lt;
> <!----> &gt;
& <!----> &amp;
" <!----> &quot;
' <!----> &apos;
<!-- Correct me if I'm wrong -->
2 Likes
81

That would prevent using HTML within posts, which from what I understood was intentional, although since you can use markdown it may be pointless and worth it :man_shrugging:

5 Likes
82

you could either…

  1. Implement custom exceptions that manually add in the few html tags supported by MD
  2. Not use HTML in MD, and create your own standards because HTML is quite dangerous
3 Likes
83

For example, I tried using markdown, but the styling and the XSS filtering was kinda messed up. personally, you don’t need HTML in MD (unless you need a summary/details group, which could be easily implemented by creating your own standards or by not implementing it at all)

2 Likes
84

The Markdown converter Element got converts to HTML…

1 Like
85

By removing certain characters, you are essentially making your users have to guess what the XSS filter will do with the message. For example, transferring code snippets would be impossible due to the removal of certain characters.

3 Likes
86

At the time, I didn’t know, and still now, I don’t have much clue about it.

What do you mean by that?

@QwertyQwerty88 Also, I was looking through the code and saw this:

# Thanks to Phind

Who is Phind? @python660?

1 Like
88

not me, my name starts with J

1 Like
89

Typo

https://www.phind.com/

Not enough people know about him

4 Likes
90

@element1010 you should add the time posts were posted.

1 Like
91

Yes, I’m planning on that.

92

I personally prefer x {units} ago as that way you can take a screenshot without having to blur out your timezone. Perhaps you could add that too as a toggled feature?

4 Likes