Comments on: Ex-Image Formatting

Ex-Image Formatting

mr_crash_davis — Sat, 18 Nov 2006 16:21:10 -0800

Since you're already stripping out the image tag code (like on this post), why not either change it to a link or drop the whole line entirely? The code that's left is unsightly.

By: econous

econous — Sat, 18 Nov 2006 16:29:07 -0800

[filthy.gif]

By: pyramid termite

pyramid termite — Sat, 18 Nov 2006 16:32:59 -0800

[photo of someone dental flossing his ears]

By: Ceiling Cat

Ceiling Cat — Sat, 18 Nov 2006 16:36:20 -0800

Hi!

By: yeoz

yeoz — Sat, 18 Nov 2006 16:48:03 -0800

Holy crap', it's Ceiling Cat!

By: Rhomboid

Rhomboid — Sat, 18 Nov 2006 16:54:23 -0800

I think the current filtering code was a quick hack in response to mock's XSS demo, and that Matt is working on proper parsing code.

By: moonbird

moonbird — Sat, 18 Nov 2006 16:57:17 -0800

Just hyperlink 'em. Using the FF extension Text to Image totally rocks and solves the problem.

By: Rhomboid

Rhomboid — Sat, 18 Nov 2006 16:59:17 -0800

Um, you're missing the point of this post entirely.

By: smackfu

smackfu — Sat, 18 Nov 2006 17:20:54 -0800

Problem is that IMG tag works in Live Preview, but not in normal preview or a post.

By: mathowie

mathowie — Sat, 18 Nov 2006 17:21:31 -0800

yeah, it was just a quick xss fix. I'll clean it up.

Also, if anyone has an idea how to filter the img tag from the live preview, that'd be good.

By: Rhomboid

Rhomboid — Sat, 18 Nov 2006 17:34:32 -0800

Problem is that IMG tag works in Live Preview, but not in normal preview or a post.

Live preview doesn't do any filtering at all. You can do all sorts of nastiness there (< SCRIPT>, CSS styles, etc) that will be filtered out when you post. So the IMG tag isn't unique at all there.

By: Rhomboid

Rhomboid — Sat, 18 Nov 2006 17:50:33 -0800

Also, if anyone has an idea how to filter the img tag from the live preview, that'd be good.

You could try instead of this:

if(isIE){ getEl("prevDiv").innerHTML="<div>"+getEl("comment").value.replace(/(\n|\r)/g,'<br/>').replace(/(<br\/><br\/>)/g,'<br/>')+"</div>" }
else{ getEl("prevDiv").innerHTML="<div>"+getEl("comment").value.replace(/(\n|\r)/g,'<br>')+"</div>" }

Something like this:

html="<div>"+getEl("comment").value.replace(/(\n|\r)/g,'<br>').replace(/<\s*img[^>]+>/gi, "[IMG tag disabled]");
getEl("prevDiv").innerHTML = isIE ? html.replace(/(<br\/><br\/>)/g,'<br/>') : html;

This is far from bulletproof in that it does tag replacement with a RE but it doesn't matter too much since it's just for preview, the real filtering is still done server-side.

By: iconjack

iconjack — Sat, 18 Nov 2006 18:27:16 -0800

I know I missed it when it happened but why did the img tag get axed in the first place? Just wondering.

By: interrobang

interrobang — Sat, 18 Nov 2006 18:30:25 -0800

We were having too much fun with it, so Matt took it away.

By: interrobang

interrobang — Sat, 18 Nov 2006 18:32:06 -0800

It's in his desk drawer, next to our yo-yos, science fiction comic books, and wind-up chattering teeth. If you want to help me get it back, meet me behind the school at 3 o'clock.

By: timeistight

timeistight — Sat, 18 Nov 2006 18:38:15 -0800

I know I missed it when it happened but why did the img tag get axed in the first place? Just wondering.

Good question! Why don't you make a MetaTalk post about it?

By: dame

dame — Sat, 18 Nov 2006 18:43:28 -0800

No, no, interrobang. It's because crunchland's bitching finally worked. Take it as a lesson: if you bitch long enough, you will win. But you have to be really committed. Try it out!

By: taosbat

taosbat — Sat, 18 Nov 2006 19:10:14 -0800

Can someone explain it to me what EXACTLY we are protecting ourselves from by blocking images (besides, you know, the guy fucking a chicken)?

That's about it, right?

By: interrobang

interrobang — Sat, 18 Nov 2006 19:15:37 -0800

That was the excuse, yeah.

By: Alvy Ampersand

Alvy Ampersand — Sat, 18 Nov 2006 19:22:14 -0800

God, I miss that dancing squirrel playing a harmonica.

By: Alvy Ampersand

Alvy Ampersand — Sat, 18 Nov 2006 20:14:33 -0800

Also, since this thread's original issue has been adressed and I'm pretty sure another Yeah Pix!/Nay Pix! thread isn't all that necessary, let's discuss this thread.

An interesting and heartbreaking story, the thread is marred by the usual sanctimony and indignance pissing contests.

By: econous

econous — Sat, 18 Nov 2006 20:23:18 -0800

Self righteousness is a defining feature of metafilter. Fistulas are less entertaining.

By: quonsar

quonsar — Sat, 18 Nov 2006 20:46:38 -0800

Live preview doesn't do any filtering at all.

and thus, though i didn't think it was possible, becomes even less live and less a preview. mefi is such grand entertainment sometimes!

By: blue_beetle

blue_beetle — Sat, 18 Nov 2006 20:51:36 -0800

Since you're already stripping out the image tag code (like on this post), why not either change it to a link or drop the whole line entirely? The code that's left is unsightly.

Ok, I'll get right on that. Oh, wait, you weren't addressing me. Hmm, I guess I somehow must have stumbled upon a private email exchange... No, wait, it's on the front page of MeTa. Hmm, must be that fancy new 2nd person perspective that everyone is talking about on the intertubes.

By: Rhomboid

Rhomboid — Sat, 18 Nov 2006 21:05:27 -0800

That comment of mathowie's you linked to is completely wrong. Specifically, that php file grabs any and all cookie data from the metafilter user, since the script is run within an image tag on the metafilter.com site is totally incorrect. The browser presents the cookies of the site the image is hosted AT, not where it was linked FROM. If you control http://yourserver.com/omg/haha-funnier-than-FARK.jpg then the only cookies you see in the request are the ones set by yourserver.com. I really hope we didn't go through this whole ordeal because of THAT misconception.

By: quonsar

quonsar — Sat, 18 Nov 2006 21:12:40 -0800

shhh. you're making him look bad.

By: quonsar

quonsar — Sat, 18 Nov 2006 21:14:00 -0800

IM N UR IMG TAG RUNNIN MY SCRIPT

By: smackfu

smackfu — Sat, 18 Nov 2006 21:31:27 -0800

I really hope we didn't go through this whole ordeal because of THAT misconception.

I thought we went through it because you posted an image that made anyone who saw it favorite your comment.

By: homunculus

homunculus — Sat, 18 Nov 2006 21:38:25 -0800

Waitaminute, someone here fucked a chicken?

By: blasdelf

blasdelf — Sat, 18 Nov 2006 22:07:03 -0800

mathowie can't regex his way out of a paper bag — we can't use the lowercase letters {s,r,c} concatenated together in that order, in a comment or post on this here community weblog. It's a good thing those three letters don't appear in that order with any frequency in the english language.

If we're going to not have inline images (which is okay by me), <img> tags should be getting transformed server-side into something useful, not mangled incompetently. Maybe something like:

<IMG SRC="http://goatse.cx/hello.jpg" title="gaping asshole">

turns into

<div class="image"> <IMG SRC="http://metafilter.com/littleImageIcon.png"> <a href="http://goatse.cx/hello.jpg">gaping asshole</a> </div>

with a little bit of differentiating style applied to the image class in the css. In the absence of a title tag, the link text would be the image URL. Having them in their own div would make it super retardedly easy to do inlining in greasemonkey.

By: Rhomboid

Rhomboid — Sat, 18 Nov 2006 22:37:04 -0800

I thought we went through it because you posted an image that made anyone who saw it favorite your comment.

Yes, and Matt subsequently fixed that problem the same day by switching from GET to POST. That doesn't give people an excuse to parade around untrue myths about how cookies work.

By: delmoi

delmoi — Sat, 18 Nov 2006 23:01:30 -0800

Woah woah woah. I thought the problem was people doing something like this:

<img ="http://www.metafilter.com/favorite.mefi?comment=360647">

It used to be that if someone did something like that, every person who viewed the page would favorite comment 360647. That was the problem, but now it's fixed.

Still I'm not sure I really want the image tag back, there were a lot of threads I think people would have just shoved images into that otherwise ended up having a conversation, for better or for worse.

By: delmoi

delmoi — Sat, 18 Nov 2006 23:02:20 -0800

By: delmoi

delmoi — Sat, 18 Nov 2006 23:02:46 -0800

mathowie can't regex his way out of a paper bag — we can't use the lowercase letters {s,r,c} concatenated together in that order

Woah, you're right.

By: Rhomboid

Rhomboid — Sat, 18 Nov 2006 23:21:14 -0800

You can still say src with the help of your friend U+200B.

By: flapjax at midnite

flapjax at midnite — Sun, 19 Nov 2006 00:00:44 -0800

Y'all shore dew tawk funny...
'N how come there ain't no pikchers here on Metrofilter no more?

By: languagehat

languagehat — Sun, 19 Nov 2006 06:29:50 -0800

It's in his desk drawer, next to our yo-yos, science fiction comic books, and wind-up chattering teeth.

So that's where my yo-yos, science fiction comic books, and wind-up chattering teeth went! Damn you, mathowie!

*weeps bitter tears, vows revenge*

By: quonsar

quonsar — Sun, 19 Nov 2006 07:14:55 -0800

mathowie can't regex his way out of a paper bag

fricken hilarious...

By: Mid

Mid — Sun, 19 Nov 2006 08:47:32 -0800

Oh, this must be the annual quonsar chest-thump about how he'd use his skillz to code up a real website, if only Matt would stop making him visit this one.

By: tkolar

tkolar — Sun, 19 Nov 2006 09:33:08 -0800

Perhaps a better way to deal with the img tag is to automatically replace the image location with a metafilter hosted jpg that explains why IMG tags are not allowed.

At least it might cut down on the number of img-related threads in MetaTalk.

By: shmegegge

shmegegge — Sun, 19 Nov 2006 15:40:41 -0800

testing...

By: shmegegge

shmegegge — Sun, 19 Nov 2006 15:41:04 -0800

holy shit, we really can't put s r c together. that's nuts.

By: pyramid termite

pyramid termite — Sun, 19 Nov 2006 15:42:54 -0800

there goes my post about detroit rock and roll in the 60s, damn it ...

By: Rhomboid

Rhomboid — Sun, 19 Nov 2006 16:28:02 -0800

src src src src src src

By: blasdelf

blasdelf — Sun, 19 Nov 2006 18:12:49 -0800

THE JOYS OF THE LETTER R IN UNICODE:

{r, ŕ, ŗ, ř, ʀ, ʁ, ɼ, ɺ, ɹ} — The standard latin set

{Ꭱ, Ꮢ} — R-like charachters in Cherokee

{ᴙ, ᴚ, ᵣ, ᶉ} — IPA

{ṙ, ṛ, ṝ, ṟ} — Latin Extended

{ℛ, ℜ} — Letter-like forms (the blackletter one is ℜ)

{⒭, ⓡ} — enclosed alphanumerics

{�, �, �, �, �, �, �, �, �, �, �, �, �} mathematical alphanumerics
(has a lot of small r characters, but font presence is unlikely)

{ｒ} — fullwidth (used with CJK)

<img sṛc="http://goatse.cx/hello.jpg">

By: blasdelf

blasdelf — Sun, 19 Nov 2006 18:15:02 -0800

gah! I meant to say that the blackletter one is {& real ;} but the site transforms {& amp ;} into a real &.

By: Rhomboid

Rhomboid — Sun, 19 Nov 2006 18:26:56 -0800

&
&real;
src

U+200B is where it's at. No fake r's here.

By: quonsar

quonsar — Sun, 19 Nov 2006 19:41:53 -0800

10 GOTO 20
20 GOTO 10

By: dg

dg — Sun, 19 Nov 2006 20:33:32 -0800

quonsar, that looks like the code that governs my life.

By: blasdelf

blasdelf — Sun, 19 Nov 2006 21:16:23 -0800

ZERO WIDTH SPACE [] (U+200B)

On my mac, your beloved U+200B prints as a not-quite-full-width space in Verdana, so it doesn't work

Fortunately, there are a multitude of awesome characters in Unicode for our uses:

HAIR SPACE [ ] (U+200A)

NARROW NO-BREAK SPACE [ ] (U+202F)

ZERO WIDTH NO-BREAK SPACE [] (U+FEFF)

WORD JOINER [⁠] (U+2060)

ZERO WIDTH JOINER [‍] (U+200D)

ZERO WIDTH NON-JOINER [‌] (U+200C)

LEFT-TO-RIGHT MARK [‎] (U+200E)

<img s‎r‎c="http://goatse.cx/hello.jpg">

By: blasdelf

blasdelf — Sun, 19 Nov 2006 21:18:14 -0800

MISSION ACCOMPLISHED! I ❤ U+200*

By: crunchland

crunchland — Sun, 19 Nov 2006 21:36:11 -0800

So much for Quonsar's leet mad programming skillz. His program is twice as long as it needed to be.

10 GOTO 10 would have sufficed.

By: cgc373

cgc373 — Mon, 20 Nov 2006 07:59:58 -0800

crunchland, why do you cap the q?

By: crunchland

crunchland — Tue, 21 Nov 2006 04:20:52 -0800

Putting a cap in Quonsar has always been a dream of mine.