Comment

Comment by mbrock

Cool!

If you're not 100% sure that the GitHub data fields (bio, name, etc) are stripped of markup, please ensure that your widget isn't vulnerable to cross-site scripting (XSS).

There are GitHub users whose bios, names, etc contain HTML fragments. The way that your code inserts those fields is likely to be vulnerable. It's better to explicitly treat the fields as text, e.g. by using jQuery's text() method.

parent mbrock 10 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton