Scratch

It's done!
Download here: http://www.cfagency.org/antidote.user.js
EDIT: HTML has been disabled.
ENJOY!

Last edited by GeonoTRON2000 (2012-03-26 10:34:39)

nathanprocks wrote:

GeonoTRON2000 wrote:

It now passively enables HTML.
For example:
<input type="text" value="You can't do this in BBCode." />

This is very insecure. That is why Rookwood101 didn't put that in his code (and also made it hard to hack the tags to add code too).

Wassa da matta?  Afraid of a little IFrame?

It can embed projects...
<tested>

Last edited by Squawkers13 (2012-03-26 10:29:39)

[img]http://4.bp.blogspot.com/-_oUAdpmJXpM/T0rtXW6f5OI/AAAAAAAAC0A/YH8l3SEFo-k/s1600/testing-testing-123.jpg onload=javascript:alert("If you're seeing this in an alert box, the userscript isn't secure.");[/img]

Edit: I don't see an alert box. I guess it's secure.

Last edited by zippynk (2012-03-26 10:52:34)

LS97 wrote:

Hardmath123 wrote:

<script type="text/javascript">
while(true)
{
alert("Nah, just this sort of thing.");
}
</script>

That's why you use Chrome -- it blocks multiple dialogue boxes! 

FF gives you the option to stop them, but sometimes you want a few. 

zippynk wrote:

http://4.bp.blogspot.com/-_oUAdpmJXpM/T … e.')"

Edit: I don't see an alert box. I guess it's secure.

Try now.

Squawkers13 wrote:

<image>
http://4.bp.blogspot.com/-_oUAdpmJXpM/T0rtXW6f5OI/AAAAAAAAC0A/YH8l3SEFo-k/s1600/testing-testing-123.jpg onload=javascript:alert("If you're seeing this in an alert box, the userscript isn't secure.");
<image>

Actually, the BBCode is img, and so is the HTML tag.
[img]http://4.bp.blogspot.com/-_oUAdpmJXpM/T0rtXW6f5OI/AAAAAAAAC0A/YH8l3SEFo-k/s1600/testing-testing-123.jpg onload=javascript:alert("If you're seeing this in an alert box, the userscript isn't secure.");[/img]

Do you think you could not call it antidote?

And also I don't see why you feel the need to remake something that has already been made, without adding any new features (well a few but not many) and it writing such an insecure version.

Last edited by rookwood101 (2012-03-27 11:15:03)

[img]" /><img src="http://i.imgur.com/7lUPz.png" onload="while(true){alert('remove the script!')};" style="max-width: 510px;[/img]

Last edited by roijac (2012-04-07 16:17:23)

Teehee.  New version.  All onloads disabled.

GeonoTRON2000 wrote:

Teehee.  New version.  All onloads disabled.

teehee. new image onload version. your code is still unsecure.

This discussion is continued here: http://geonotron.net84.net/forums/viewt … =6&t=3

close topic