Code push happening tomorrow!

[karzilla]

We are planning to do a code push within the next 24 hours, around 7:30pm PDT / 10:30pm EDT. (timezones)

You can see what's new in the code tour that was posted earlier this week, but here are the highlights:

• Google Analytics v4 support
• adding the legacy RTE to the beta Create Entries page
• adding draft autosave to the beta Create Entries page
• more UI improvements for the beta Inbox
• some more aggressive measures for discouraging SEO spam accounts
• miscellaneous modernization updates for various journal styles
• many newly added sites for content embeds and username styling
• new color picker for the journal style customization page
• new CSS wrappers to allow styling of entry cut links

We'll update here once the new code is live!

Comments

Re: CSS escaping

[denise]

That's a security related restriction -- it was put in place because there's a category of exploits that used to be very common on LiveJournal that can happen if you don't clean certain byte strings out of user-generated CSS classes, and the fix for it has to be a little over-cautious and just clean all Unicode. Theoretically, we could probably look into whether we can step back some of the restrictions given the advances in browser technology, but it hasn't been a priority (and is unlikely to be a priority in the future) because of the risk of re-introducing security attack vectors if we aren't extremely careful and we've prioritized other efforts instead.

EDIT: actually nevermind! our security person did do that analysis while I wasn't paying attention and this next code push should reduce the restrictions on Unicode in CSS a lot. Sorry for the bad info!

Re: CSS escaping

[tennoseremel]

Nice :) Although all of that could probably be less of a problem with BUG #3046: [wish] Consider not inlining custom CSS maybe?

UPD: And, for the record, I meant content: "Unicode string here"; not classes, per se.

Re: CSS escaping

[momijizukamori]

You should be good to go on unicode in content values now! The attack pattern it was meant to mitigate is not a thing in modern browsers (apparently it used to be possible to make CSS run JS, which is one of the most cursed things I've heard).

Re: CSS escaping

[tennoseremel]

momijizukamori, appears to be working (example: link at the end of the text has “identification card” Unicode character), thank you :)

apparently it used to be possible to make CSS run JS, which is one of the most cursed things I've heard

Ouch. Sounds very cursed indeed.