Hacker News new | ask | show | jobs
by saagarjha 2229 days ago
I stubbornly refuse to serve JavaScript on my website, but perhaps I can whip up a snippet that you can self-XSS yourself with.
1 comments

How's this?

  document.body.innerHTML=document.body.innerHTML.replace(/\$[\w_]*/g,'<span contenteditable role="$&" style="border:dashed 1px gray">$&</span>');document.querySelectorAll('span[role]').forEach(s=>s.addEventListener('input',e=>document.querySelectorAll('span[role="'+e.target.getAttribute('role')+'"]').forEach(t=>t!=e.target&&(t.textContent=e.target.textContent))))