Untitled attachment

Notices where this attachment appears

1. Alex Gleason (alex@gleasonator.com)'s status on Friday, 09-Feb-2024 06:24:36 JST Alex Gleason

   in reply to
   @graf I'm paranoid now. So I need to understand what really happened before I do something like, add Nostr keys into Soapbox browser storage.
   
   I still don't know how the script closing tag is somehow used as an opening tag. But this confirms at least that there are serious problems in Pleroma FE's html parser. There's just a tiny missing piece I haven't found.
   
   Pleroma on the backend is also at fault for not sanitizing it correctly. I was able to confirm that DOMPurify (in TypeScript) does the right thing. So in case anyone thinks I'm crazy for writing a TypeScript backend, this is why.