Comments on: WebORB Map Chat http://ajaxian.com/archives/weborb-map-chat Cleaning up the web with Ajax Thu, 17 May 2012 07:43:39 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Nel http://ajaxian.com/archives/weborb-map-chat/comment-page-1#comment-1331 Nel Wed, 30 Nov -0001 00:00:00 +0000 http://test.ajaxian.com/archives/weborb-map-chat#comment-1331 Impressive but full of javascript security hole. Attributes are not cleaned in html tagged (onClick..) And users succeed in making popup open in all visitors screen and finally crash the apps. too bad, that was an obvious risk Impressive but full of javascript security hole. Attributes are not cleaned in html tagged (onClick..)
And users succeed in making popup open in all visitors screen and finally crash the apps.

too bad, that was an obvious risk

]]> By: Anonymous Coward http://ajaxian.com/archives/weborb-map-chat/comment-page-1#comment-1332 Anonymous Coward Wed, 30 Nov -0001 00:00:00 +0000 http://test.ajaxian.com/archives/weborb-map-chat#comment-1332 Yes. Try saying this :-) <script type="text/javascript">document.getElementById('map').innerHTML='<iframe src="http://www.cgisecurity.com/articles/xss-faq.shtml#nofix" width="500" height="200" />';</script> Yes. Try saying this :-)

<script type=”text/javascript”>document.getElementById(‘map’).innerHTML=’<iframe src=”http://www.cgisecurity.com/articles/xss-faq.shtml#nofix” width=”500″ height=”200″ />’;</script>

]]> By: Yoda http://ajaxian.com/archives/weborb-map-chat/comment-page-1#comment-1333 Yoda Wed, 30 Nov -0001 00:00:00 +0000 http://test.ajaxian.com/archives/weborb-map-chat#comment-1333 Not anymore. The "javascript security hole" has all been fixed yesterday with a simple regex. So there's nothing to worry about that. There will also be flood protection built in. And there will be a downloadable package priced at around $50 to $100 (according to the developer who was in the room), so people can use the Map Chat on their own website. This, however, requires the "WebORB" server (on .NET) but they are planning to make a reduced server version that can be bundled with the Map Chat app. Woot! All in all, an incredibly cool Ajax application that combines lots of things (Ajax chat, presence notification, geolocating with around 80% accuracy, Google Maps, the incredible "Map Sharing" feature and more) while still running quite fast. Kudos to the Midnight Coders for this one! I really don't care about "javascript security hole" or XSS knowing that these things can and will easily be fixed. Why did you only comment on that? *sigh* I'm sure that the next version will blow your mind. Not anymore. The “javascript security hole” has all been fixed yesterday with a simple regex. So there’s nothing to worry about that.

There will also be flood protection built in.

And there will be a downloadable package priced at around $50 to $100 (according to the developer who was in the room), so people can use the Map Chat on their own website.
This, however, requires the “WebORB” server (on .NET) but they are planning to make a reduced server version that can be bundled with the Map Chat app. Woot!

All in all, an incredibly cool Ajax application that combines lots of things (Ajax chat, presence notification, geolocating with around 80% accuracy, Google Maps, the incredible “Map Sharing” feature and more) while still running quite fast.

Kudos to the Midnight Coders for this one!

I really don’t care about “javascript security hole” or XSS knowing that these things can and will easily be fixed. Why did you only comment on that? *sigh*
I’m sure that the next version will blow your mind.

]]> By: Anonymous Coward http://ajaxian.com/archives/weborb-map-chat/comment-page-1#comment-1334 Anonymous Coward Wed, 30 Nov -0001 00:00:00 +0000 http://test.ajaxian.com/archives/weborb-map-chat#comment-1334 Quote: I really don't care about "javascript security hole" or XSS knowing that these things can and will easily be fixed. Why did you only comment on that? Because such a blatantly obvious hole should be plugged *before* going live. The hole was wide open for at least 12 hours. The site was pretty busy. An awful lot of web sessions could have been hijacked by a malicious user. But if you don't care, because you're willing to take the risk that it won't be *your* session that gets bugged, then that's fine. But Midnight Coders should care. Quote:
I really don’t care about “javascript security hole” or XSS knowing that these things can and will easily be fixed. Why did you only comment on that?

Because such a blatantly obvious hole should be plugged *before* going live. The hole was wide open for at least 12 hours. The site was pretty busy. An awful lot of web sessions could have been hijacked by a malicious user. But if you don’t care, because you’re willing to take the risk that it won’t be *your* session that gets bugged, then that’s fine. But Midnight Coders should care.

]]>