Whoops. Yeh I'm working on the encoding thing atm. Thank you for flagging! EDIT: I'm relying on the 'marked' npm package for markdown and it is handling the linkification of URLs, sometimes badly. Shall work on it.
back
2 comments
Since marked doesn't do it for you, make sure you sanitize the user input (the text on the user profiles) before rendering it to visitors.
Some libraries for doing that with good defaults:
- https://github.com/cure53/DOMPurify
- https://github.com/apostrophecms/sanitize-html
- https://github.com/bevacqua/insane
(right now your site looks vulnerable to XSS)
Yeh I'm sanitizing already thankfully. I've fixed the decoding issue, but I'm expecting some % of users to be borked for a whole other variety of quirky reasons.
Nice :)
Ah, I bet you discovered that subdomains aren't case-sensitive while HN usernames are case-sensitive, didn't you? :)
HN usernames aren't case-sensitive:
> That username conflicts with an existing one. Names are case-insensitive. Please choose another.
They're case-sensitive for the purpose of scraping a profile page.
https://news.ycombinator.com/user?id=Retr0id - 200
https://news.ycombinator.com/user?id=retr0id - 404 (Edit: 200 now?)
That second one doesn't give me a 404 but correctly shows your profile.
Weird, it also works for me now, I could've sworn it didn't work before.
The firebase API on the other hand remains case-sensitive:
https://hacker-news.firebaseio.com/v0/user/Retr0id.json => full response
https://hacker-news.firebaseio.com/v0/user/retr0id.json => null
maybe wrap it in three backticks on a line before and after?
For example...
Markdown Content
...
```
-- BEGIN PGP...
https://news.ycombinator.com/user?id=yourname
yourname.at.hn
--- signature
```