These XSS sanitization bugs don't seem to ever stop.
The simplest and safest solution for sites would be to implement Content-Security-Policy with a good script-src (with limited sources and without the 'unsafe-inline' escape hatch).
Unfortunately, even HN itself uses a script-src with unsafe-inline, and it allows everything on cloudfare's CDN...
The simplest and safest solution for sites would be to implement Content-Security-Policy with a good script-src (with limited sources and without the 'unsafe-inline' escape hatch).
Unfortunately, even HN itself uses a script-src with unsafe-inline, and it allows everything on cloudfare's CDN...