Thank you for spotting this! I updated the code to escape some special characters.

For people reading this, the parent comment is referring to this line[1] from a previous revision of the gist.

[1]: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...

> For people reading this, the parent comment is referring to this line[1] from a previous revision of the gist.

That was not the line, it was linking to this innerHTML call: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...

Also as a defense mitigation I don't think escaping is ever going to be effective, it would be better to create anchor elements directly. With your current approach I can still XSS with, for instance:

    https://"onmouseenter=alert(1)"

Thanks! For now, I added a warning under the gist. Not that this is an excuse, but I put this together in about 30 minutes using GPT-4 for fun without much consideration about robustness or security. I will maybe try to rewrite it when I find time.

Please do! Besides being a fun exercise it’s also a neat idea. Comments from the HN community make the content posted almost always more interesting imho

I took the advice and updated the code to generate DOM nodes instead of setting HTML directly - it should decrease the risk of XSS

Thanks! That’s even better — although I think you’d need to create an extension out of this to be able to do that.

I honestly did not know spoonerisms were a speech impediment. In fact, I only learnt of them recently when I discovered Nacker Hews[1] here on HN, and thought it was quite humorous. I am sorry to have hurt you in any way. I should definitely research more next time.

[1] http://www.nackerhews.com/

Made a VS Code extension called Slowbug that lets you debug the code by running it slowly.

https://github.com/postmalloc/slowbug

The interface reminds me of Andy Matuschak's notes https://notes.andymatuschak.org/About_these_notes

I'm guessing this post is making rounds because George Hotz asked people to read it on one of his Twitch streams yesterday.