[arkadiyt]

Heads up this is vulnerable to cross site scripting [1]. If someone submits a link like:

    https://example.com"><script>alert(1)</script>

Then simply viewing the hackernews index page with this extension installed will let the submitter execute whatever javascript they want in your logged in hackernews context - no user interaction necessary.

[1]: https://github.com/MostlyEmre/hn-anti-paywall/blob/main/scri...

[MostlyEmre]

I can't thank you enough for pointing that out. Appreciated. I looked into it and pushed an update, hopefully it should fix it. I no longer use innerHTML, instead I now generate links properly via createElement, appendChild, all that jazz.

GreasyFork build is also updated. I recommend anyone who installed the userscript (thanks!) to update.

[dylan604]

Does HN allow links like that?

[ehPReth]

it does... but it's urlencoded so unsure if vulnerable with this user script: https://news.ycombinator.com/item?id=33796527

still a good idea to patch though

[dylan604]

a) I'd never run an extension like this.

b) for the auth, yeah, probably a good idea to patch

c) for HN, probably a good idea to sanitize those inputs!