This commit is contained in:
Mark Nadal 2019-03-21 14:39:23 -07:00
parent 2baa85c082
commit 116a2521df
12 changed files with 44156 additions and 87 deletions

View File

@ -8,6 +8,8 @@
# an installer that will automatically do it for you.
#debian/ubuntu
su -
apt-get install sudo -y
sudo apt-get update -y
sudo apt-get install curl git git-core -y
#fedora/openSUSE

View File

@ -4,7 +4,7 @@
<title>Party by Neon ERA</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="./style.css">
<link href="https://fonts.googleapis.com/css?family=Alegreya+Sans:300italic" rel="stylesheet" type="text/css">
<link href="https://fonts.googleapis.com/css?family=Raleway:100" rel="stylesheet">
<link href="https://fonts.googleapis.com/css?family=Caveat" rel="stylesheet">
<style>
.write {
@ -69,13 +69,30 @@
#hi .faces img {
w-idth: 5%;
width: 3em;
width: 7vh;
}
#hi .ton {
border-radius: 1em;
font-size: 150%;
font-size: 2.25vmax;
margin: 0 0.5em 0 0.5em;
background: transparent;
border: 1px solid white;
color: white;
font-family: 'Raleway', sans-serif;
}
#hi .ton:hover {
background: white;
color: black;
}
</style>
<div class="loud write shout rim">Party by NEON ERA.</div>
<div class="loud write shout rim">Join the Private Party!</div>
<div id="faces" class="flush faces">
<div class="right" style="max-width: 20em;">
<input id="halias" class="write jot sap" placeholder="username">
<input id="hpass" type="password" class="write jot sap" placeholder="passphrase">
<div class="right" style="max-width: 30em;">
<a href="chrome://extensions" target="_blank"><button class="ton">Install Now</button></a>
<a href="#"><button class="ton">How It Works</button></a>
<!-- input id="halias" class="write jot sap" placeholder="username">
<input id="hpass" type="password" class="write jot sap" placeholder="passphrase" -->
<script>
$.as.route.page('hi', () => {
$('#hpass').on('focus', () => {
@ -136,6 +153,14 @@
return faces;
});
</script>
<div class="pad ditch">
<p class="loud"><i>Your friend has invited you to add a privacy extension to your browser:</i></p>
<p> - Decrypts your friends' messages across any site!</p>
<p> - Stops tech monopolies from selling your private data to advertisers.</p>
<p> - Gives you ownership and control over all your data online.</p>
<p> - Creates a searchable history of your posts, friends, and more!</p>
</div>
<div id="faces2" class="flush faces"></div>
<div class="pad ditch">
<p class="loud"><i>Express your thoughts & connect with the world around you!</i></p>
<p> - Discover new relationships.</p>
@ -143,12 +168,10 @@
<p> - Watch fun videos and photos from people who share.</p>
<p> - But this time, you own it: fully decentralized.</p>
</div>
<div id="faces2" class="flush faces">
</div>
<div class="pad ditch" style="margin-top: 1em;">
<p><span class="loud write shout">Welcome</span><span class="write loud">, you are currently connected to <b id="peers" class="huet4">2</b> peers. <b>Why not try to sign up or log in?</b></span></p>
<p><span class="loud write shout">Welcome,</span><!-- span class="write loud">, you are currently connected to <b id="peers" class="huet4">2</b> peers. <b>Why not try to sign up or log in?</b></span --></p>
<p> - Your identity is created here, by you. Not on a server.</p>
<p> - It uses secure <a href="https://gun.eco/explainers/data/security.html">cryptographic</a> methods to protect you.</p>
<p> - It uses secure <a href="https://gun.eco/docs/Cartoon-Cryptography">cryptographic</a> methods to protect you.</p>
<p> - Only you have access to it, meaning even we cannot reset your password!</p>
<p> - For added security, you can freely <a href="https://github.com/amark/gun">download</a> and run it on your own computer.</p>
</div>
@ -718,7 +741,7 @@
if(e.err){ return }
var m = $($("#d"+e.id)[0] || $('#d0').clone(true,true).attr('id', 'd'+e.id).css('backgroundImage', '').appendTo('#draft')).addClass('pulse');
if(up){ return up.shrink(e, resize, 1000) }
console.log(e.id, e.base64);
//console.log(e.id, e.base64);
m.removeClass('pulse').css({
backgroundImage: 'url(' + e.base64 + ')',
backgroundRepeat: 'no-repeat',
@ -727,7 +750,7 @@
});
});
</script>
<!-- script async src="../../gun/lib/fun.js"></script -->
<script async src="../../gun/lib/fun.js"></script>
<script async src="../../gun/lib/normalize.js"></script>
<script async src="../../gun/lib/monotype.js"></script>
<script async src="../../gun/lib/meta.js"></script>

View File

@ -1,12 +1,10 @@
@import url(https://fonts.googleapis.com/css?family=Oxygen);
html, body {
margin: 0;
padding: 0;
font-family: 'Oxygen', 'Trebuchet MS', arial;
position: relative;
background: black;
color: white;
b-ackground: black;
c-olor: white;
}
body {
@ -43,6 +41,10 @@ ul, li {
list-style: none;
}
[contenteditable=true]:empty:before {
content: attr(placeholder);
}
.model, .none { display: none }
.hide {
opacity: 0;
@ -107,6 +109,10 @@ ul, li {
.loud {
font-size: 150%;
}
.shout {
font-size: 36pt;
font-size: 6.5vmax;
}
.jot {
border-bottom: 1px dashed #95B2CA;
}

View File

@ -1,27 +1,17 @@
$(function(){
var m = window.meta = {edit:[], os:{}}, ua = '', u;
try{ua = navigator.userAgent.toLowerCase()}catch(e){}
m.os.is = {
win: (ua.search("win") >= 0)? "windows":false,
lin: (ua.search("linux") >= 0)? "linux":false,
mac: (ua.search("mac") >= 0)? "macintosh":false,
and: (ua.search("android") >= 0)? "android":false,
ios: (ua.search('ipod') >= 0
|| ua.search('iphone') >= 0
|| ua.search('ipad') >= 0)? "ios":false
}
var k = m.key = {ctrl: 17, cmd: 91};
k.meta = (m.os.is.win||m.os.is.lin||m.os.is.and)? k.ctrl : k.cmd;
var m = window.meta = {edit:[]}, u;
var k = m.key = {};
k.meta = {17:1, 91:1, 93:1, 224:1};
k.down = function(eve){
if($(eve.target).is('input') || eve.repeat){ return }
(k.eve = m.eve = eve).which = eve.which || eve.fake || eve.keyCode;
if(!eve.fake && eve.which === k.last){ return }
if(k.meta === (k.last = eve.which)){ k.down.meta = m.flip(k.wipe()) || true }
if(k.meta[(k.last = eve.which)]){ k.down.meta = m.flip(k.wipe()) || true }
if(m.flip.is()){
(k.combo || (k.combo = [])).push(eve.which);
m.check('on', eve.which, k.at || (k.at = m.edit));
}
if(eve.metaKey && (k.meta !== eve.which)){ k.up(eve) } // on some systems, meta hijacks keyup
if(eve.metaKey && (!k.meta[eve.which])){ k.up(eve) } // on some systems, meta hijacks keyup
}
k.up = function(eve){ var tmp;
if($(eve.target).is('input')){ return }
@ -29,7 +19,7 @@ $(function(){
k.last = null;
eve.which = eve.which || eve.fake || eve.keyCode;
if(m.flip.is()){ m.check('up', eve.which) }
if(tmp = (k.meta === eve.which)){ k.down.meta = false }
if(tmp = (k.meta[eve.which])){ k.down.meta = false }
if(tmp && k.at === m.edit){ k.wipe() }
if(27 === eve.which){ return m.flip(false) }
}
@ -355,6 +345,38 @@ $(function(){
// Size Spacing
// Size Super
// Size Sub
/*
meta.edit({name: "Edit", combo: ['E']});
meta.edit({name: "Add", combo: ['E','A'],
on: function(e){
console.log(111);
var r = m.tap.range || monotype();
r.insert($('<div>hi</div>'));
}
});
meta.edit({name: "Color", combo: ['E','C'],
on: function(e){
console.log(111);
var r = m.tap.range || monotype();
meta.ask('Color name or code?', function(color){
r.get().closest('div').css({background: color});
});
}
});
meta.edit({name: "Width", combo: ['E','W'],
on: function(e){
var r = m.tap.range || monotype(), s = e.pageX||0, on = r.get().closest('div'), was = on.width();
console.log(1);
$(document).on('mousemove.tmp', function(eve){
var w = was + ((eve.pageX||0) - was);
console.log(w);
on.css({width: w});
})
}, up: function(){
console.log(0);
$(document).off('mousemove.tmp');
}
});
*/
}());
});

View File

@ -29,12 +29,13 @@
hierarchy: ['div', 'pre', 'ol', 'ul', 'li',
'h1', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'p', 'a', // block
'b', 'code', 'i', 'span', 's', 'sub', 'sup', 'u', // inline
'br'] // empty
'br', 'img'] // empty
,tags: {
'a': {attrs:{'href':1}, exclude:{'a':1}},
'b': {exclude:{'b':1,'p':1}},
'br': {empty: 1},
'i': {exclude:{'i':1,'p':1}},
'img': {attrs:{'src':1}, empty: 1},
'span': {exclude:{'p':1,'ul':1,'ol':1,'li':1,'br':1}},
's': {space:1},
'u': {exclude:{'u':1,'p':1},space:1},
@ -138,12 +139,17 @@
return $(($(e)[0]||{})[d]);
}
var xssattr = /[^a-z:]/ig, xssjs = /javascript:/ig;
// url("javascript: // and all permutations
// stylesheets can apparently have XSS?
// create key val attributes object from elements attributes
function attrsAsObj(e, filterCb){
var attrObj = {};
(e = $(e)) && e.length && $(e[0].attributes||[]).each(function(value,name){
name = name.nodeName||name.name;
value = e.attr(name);
if(value.replace(xssattr,'').match(xssjs)){ e.removeAttr(name); return }
value = filterCb? filterCb(value,name,e) : value;
if(value !== undefined && value !== false)
attrObj[name] = value;

View File

@ -19,6 +19,7 @@
function ename(t){ return encodeURIComponent(t).replace(/\*/g, '%2A') }
function atomic(v){ return u !== v && (!v || 'object' != typeof v) }
var map = Gun.obj.map;
var LOG = false;
if(!opt.store){
return opt.log("ERROR: Radisk needs `opt.store` interface with `{get: fn, put: fn (, list: fn)}`!");
@ -167,9 +168,9 @@
}
f.write = function(){
var tmp = ename(file);
//var start = (+new Date); // comment this out!
var start; LOG && (start = (+new Date)); // comment this out!
opt.store.put(tmp, f.text, function(err){
//console.log("wrote JSON in", (+new Date) - start); // comment this out!
LOG && console.log("wrote JSON in", (+new Date) - start); // comment this out!
if(err){ return cb(err) }
r.list.add(tmp, cb);
});
@ -198,10 +199,10 @@
r.write.jsonify = function(f, file, rad, cb, o){
var raw;
//var start = (+new Date); // comment this out!
var start; LOG && (start = (+new Date)); // comment this out!
try{raw = JSON.stringify(rad.$);
}catch(e){ return cb("Record too big!") }
//console.log("stringified JSON in", (+new Date) - start); // comment this out!
LOG && console.log("stringified JSON in", (+new Date) - start); // comment this out!
if(opt.chunk < raw.length && !o.force){
if(Radix.map(rad, f.each, true)){ return }
}
@ -291,12 +292,12 @@
}
info.parsed = data.length;
//var start = (+new Date); // keep this commented out in production!
var start; LOG && (start = (+new Date)); // keep this commented out in production!
if(opt.jsonify){ // temporary testing idea
try{
var json = JSON.parse(data);
p.disk.$ = json;
//console.log('parsed JSON in', (+new Date) - start); // keep this commented out in production!
LOG && console.log('parsed JSON in', (+new Date) - start); // keep this commented out in production!
map(q, p.ack);
return;
}catch(e){ tmp = e }
@ -306,7 +307,7 @@
}
}
//var start = (+new Date); // keep this commented out in production!
var start; LOG && (start = (+new Date)); // keep this commented out in production!
var tmp = p.split(data), pre = [], i, k, v;
if(!tmp || 0 !== tmp[1]){
p.err = "File '"+file+"' does not have root radix! ";
@ -329,7 +330,7 @@
if(u !== k && u !== v){ p.disk(pre.join(''), v) }
tmp = p.split(tmp[2]);
}
//console.log('parsed JSON in', (+new Date) - start); // keep this commented out in production!
LOG && console.log('parsed JSON in', (+new Date) - start); // keep this commented out in production!
//cb(err, p.disk);
map(q, p.ack);
};

View File

@ -55,6 +55,7 @@ Gun.on('create', function(root){
if((tmp = get['%']) || opt.limit){
opt.limit = (tmp <= (opt.pack || (1000 * 100)))? tmp : 1;
}
//var start = (+new Date);
//console.log("GET!", id, JSON.stringify(key));
rad(key||'', function(err, data, o){
if(data){
@ -67,7 +68,7 @@ Gun.on('create', function(root){
}
if(!graph && data){ each(data, '') }
}
//console.log("GOT!", id, JSON.stringify(key));
//console.log("GOT!", id, JSON.stringify(key), ((+new Date) - start));
root.on('in', {'@': id, put: graph, err: err? err : u, rad: Radix});
}, opt);
function each(val, has, a,b){

2
sea.js
View File

@ -510,7 +510,7 @@
key = pair.epriv || pair;
}
var msg = (typeof data == 'string')? data : JSON.stringify(data);
var rand = {s: shim.random(8), iv: shim.random(16)};
var rand = {s: shim.random(9), iv: shim.random(15)}; // consider making this 9 and 15 or 18 or 12 to reduce == padding.
var ct = await aeskey(key, rand.s, opt).then((aes) => (/*shim.ossl ||*/ shim.subtle).encrypt({ // Keeping the AES key scope as private as possible...
name: opt.name || 'AES-GCM', iv: new Uint8Array(rand.iv)
}, aes, new shim.TextEncoder().encode(msg)));

View File

@ -0,0 +1,74 @@
<!DOCTYPE html>
<html>
<head>
<meta name="viewport" content="width=device-width, initial-scale=1">
<script src="../../../gun/examples/jquery.js"></script>
<script async src="../../../gun/lib/monotype.js"></script>
<script async src="../../../gun/lib/meta.js"></script>
</head>
<body>
<div>
<a href="java&#x09;script:alert(1)">ATTACK ME</a>
</div>
<div id="edit" contenteditable='true'>the world is a beautiful place.</div>
<div id="out">The world is a beautiful place.</div>
<div id="test">
<button id="render">render</button>
<textarea id="before"></textarea>
<textarea id="after"></textarea>
<script src="../../../gun/lib/normalize.js"></script>
</div>
<script>
$('#render').on('click', check);
$('#edit').on('keyup', check).focus();
function check(){
var a = $('#edit').html();
$('#before').val(a);
var opt = {};
opt.hierarchy = ['div', 'ol', 'ul', 'li', 'p', 'a', 'b', 'i', 'span', 's', 'sub', 'sup', 'u', 'br'];
opt.convert = {'em': 'i', 'strong': 'b', 'strike': 's', 'font': 'span'};
var b = $.normalize(a);
$('#after').val(b);
$('#out').html(b);
}
</script>
<script>
var $xss = $('<div id="xss">').appendTo('body');
$.each([
'javascript:',
'JaVaScRiPt:',
'java script:',
'java\nscript:',
'java\tscript:',
'java\0script:',
'jav&#x09;ascript:',
'jav&#x0A;ascript:',
'jav&#x0D;ascript:',
' &#14; javascript:',
'&#106;avascript:',
'&#0000106avascript:',
'&#x6A;avascript:',
'\u006Aavascript:',
'&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74:',
'&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x0003A;',
'&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;:',
'&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;',
'&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116:',
'&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058'
], function(i,v){
//console.log(v);
var s = "<div><a href='"+v+"alert(1)'>xss</a></div>";
var html = $.normalize(s);
if(html.match(/href/ig)){ alert('xss') }
$xss.append(html);
console.log(html);
});
// url("javascript: // and all permutations
// stylesheets can apparently have XSS?
</script>
<style>
button { width: 100%; }
textarea { width: 45%; height: 20em; font-size: 18pt; }
</style>
</body>
</html>

View File

@ -4,7 +4,7 @@ var config = {
servers: 1,
browsers: 2,
each: 2500,
burst: 25, // do not go below 1!
burst: 10, // do not go below 1!
wait: 1,
route: {
'/': __dirname + '/index.html',

View File

@ -1,37 +0,0 @@
<!DOCTYPE html>
<html>
<head>
<meta name="viewport" content="width=device-width, initial-scale=1">
<script src="../../../gun/examples/jquery.js"></script>
<script async src="../../../gun/lib/monotype.js"></script>
<script async src="../../../gun/lib/meta.js"></script>
</head>
<body>
<div id="edit" contenteditable='true'>the world is a beautiful place.</div>
<div id="out">The world is a beautiful place.</div>
<div id="test">
<button id="render">render</button>
<textarea id="before"></textarea>
<textarea id="after"></textarea>
<script src="../../../gun/lib/normalize.js"></script>
</div>
<script>
$('#render').on('click', check);
$('#edit').on('keyup', check).focus();
function check(){
var a = $('#edit').html();
$('#before').val(a);
var opt = {};
opt.hierarchy = ['div', 'ol', 'ul', 'li', 'p', 'a', 'b', 'i', 'span', 's', 'sub', 'sup', 'u', 'br'];
opt.convert = {'em': 'i', 'strong': 'b', 'strike': 's', 'font': 'span'};
var b = $.normalize(a);
$('#after').val(b);
$('#out').html(b);
}
</script>
<style>
button { width: 100%; }
textarea { width: 45%; height: 20em; font-size: 18pt; }
</style>
</body>
</html>

File diff suppressed because it is too large Load Diff