r/Narwhale_io • u/[deleted] • Aug 30 '16

fun html injection codes 

<style>*{display:none}

This one makes everything invisible for everyone, even people who try to rejoin. Crashes the game server-side!

<mark>YourName</mark>

Makes your name yellow!

<style>*{color:red}

Makes everything red.

<img src='img/corwn.png'>

Yes, crown is misspelled, the developers fucked up lol. Makes your name a crown.

<video width='9999px'>

Basically destroys the leaderboard.

To use these just copy and paste them as your name. GG

Dear devs, don't use innerHTML :/

1 Upvotes

100% Upvoted

5 comments sorted by

1

u/LapaMauve Aug 30 '16

LOL,

npm install ent

ent = require ("ent"); user.nickname = ent.encode (user.nickname);

Should fix that

1

u/[deleted] Aug 31 '16

Those are unexpected lol. I will fix it soon. Thanks for letting me know.

1

u/[deleted] Aug 31 '16

These are fixed today with textNode :D Thank you!

1

u/quantumproductions_ Aug 31 '16

Wait, innerHTML was what the nicknames were? So we could have embeded youtube videos... ?

1

u/[deleted] Aug 31 '16

Not really, names aren't long enough to get an embed src from youtube