Show HN: Roomchat – No signup instant custom chat rooms
roomchat.co
5 threads
XSS by writing the message:
<i<script></script>mg src="#" onerror="alert(1)">
Cool! Looks like HTML injection isn't blocked whatsoever. With chat messages being loaded as people enter, it could lead to someone exploiting everyone that enters your site.
Ha, good catch! It's just a toy at this point, but we'll fix that asap.
We created this in Meteor.js, pretty fun. Great for short term chat rooms that don't need a sign up. Would love feedback!
Please fix it : <IMG SRC=# onmouseover="alert('xxs')">
People ... It still has XSS issues ..