It's been a long time since we worked on Stack Snippets. I'm sorry. It's mostly because I created it, then I got promoted to management, and now I don't code much anymore and nobody else has time to work on it. So you can blame me.
But before you do blame me, read on for good news!
Thanks in la...
For Google lovers the Google I/O conference is currently be livestreamed: http://www.google.com/io Lot's of nitty-gritty details about Android N and stuff
I love Apple. The constant need to spend $700 each year to upgrade to the latest and greatest phone that is basically last year's phone but 2mm smaller and has 20 minutes more battery is more than enough of a reminder to keep me happy with Android
I've had my Nexus 5 for like 2 years, and it's still rock solid and ultra fast and it cost $249
Since I've snagged Mr. Boss for a minute... @Haney, the API is giving a ton of backoffs recently (in the past few days). Maybe some query plan has gone wrong?
@sandwich We call /answers on manual reports... but yeah, you're right, this is just for regular API usage. So it has something to do with /questions, likely because of SO.
so the error is because it evals the script tag contents as script
it's an escape thing somewhere in the console code. I'm sure @canon will figure it out and I can push the fix (or take a look myself in the AM)
but for now, I am out of here for the day
have a good one everybody
it's not an XSS, but it should perhaps escape strings which can contain HTML elements
@bjb568 funny thing is even that's incorrect. There's a lot of crazy evil damaging Unicode in the upper bounds: [\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]
Internet Explorer for Mac (also referred to as Internet Explorer for Macintosh, Internet Explorer Macintosh Edition, Internet Explorer:mac or IE:mac) is a discontinued proprietary web browser developed by Microsoft for the Macintosh platform. Initial versions were developed from the same code base as Internet Explorer for Windows. Later versions diverged, particularly with the release of version 5 which included the cutting edge, fault-tolerant and highly standards-compliant Tasman layout engine.
As a result of the five-year agreement between Apple and Microsoft in 1997, it was the default browser...
"message": "Uncaught SecurityError: Failed to read the 'localStorage' property from 'Window': The document is sandboxed and lacks the 'allow-same-origin' flag.",
folks who talk shit about jQuery never had to deal with the horror that was trying to make simple DOM manipulation work in both IE6, mac-IE, and Firefox. That sorta madness could just ruin your whole week.
"I'll just make this class swapping routine a little bit easier to read... OH NOES, EVERYTHING IS 500x SLOWER NOW"
@Quill Regarding the bug you reported... because that script is in the body of the markup, the </script> within the string actually gets parsed as a closing script tag by the DOM parser
On the one hand if I have
<script>
var s = 'Hello </script>';
console.log(s);
</script>
the browser will terminate the <script> block early and basically I get the page screwed up.
On the other hand, the value of the string may come from a user (say, via a previously submitted form, and now ...
when the browser parses <script>console.log("</script>")</script> you will get an error. Without ever including my console script
it's the danger of using a string literal in the body of a <script> element
you simply have to escape that slash
and life goes on
so, the question is... do we ask Haney to do some snippet pre-processing before he sets the iframe content?
user315433
Interesting: the Twitter account @GoogleAppsDev follows 26 users, with Joel Spolsky among them (who apparently was second to be followed). Didn't know he had to do much with Google Apps.
PSA: My account is set up to report flags here that occur in SE chat. If a diamond or italic has a problem with this, please ping me and I'll kill it rather than kicking me.
That... still seems like a bad idea. Especially to report here - unless you think that some folks here can get a better grip on the situation, but mods/10kers usually do that decently...