hncard

Fixed the issue, by sanitizing the scrapped html. Here is the commit https://github.com/mudulo/hncard/commit/6f5d2c9dae1aee5cf6fa... Thank you Again. I learnt something.

Okay, I don't want/mean to be impolite, but all of the 15 commits I see after forking isn't really significant; Is this really a Show-HNable item? I see you updated jQuery[0], added your screenshot[1] & edited the Readme each with trivial small edits[2]... and out of the 15 commits 11 commits is related to the screenshot and Readme. I can't see any new code written, I can't help but suspect that this repo & account was made to get karma... If you would like some project ideas, I would urge you to modify the styles of the current HNCard plugins to match the HN asthetics; like non-styled buttons/links with the beige background colors and less margin. [0] https://github.com/mudulo/hncard/commit/808060e869efc8205184... and https://github.com/mudulo/hncard/commit/808060e869efc8205184... [1] https://github.com/mudulo/hncard/commit/cdfc024ba6aef

This extension is trivially vulnerable to XSS - anyone can write javascript in their HN bio and it will execute in your logged-in context if you mouse over their profile. Here's the relevant code: https://github.com/mudulo/hncard/blob/master/chrome/js/hnpro...