This is trivially vulnerable to XSS [1]. Someone can leave a comment of the form:
https://"><script>alert(1)</script>
and if you click the bookmarklet for the page that comment was discussing then their javascript will execute in your logged in context on that website.
Also as a defense mitigation I don't think escaping is ever going to be effective, it would be better to create anchor elements directly. With your current approach I can still XSS with, for instance:
Thanks! For now, I added a warning under the gist. Not that this is an excuse, but I put this together in about 30 minutes using GPT-4 for fun without much consideration about robustness or security. I will maybe try to rewrite it when I find time.
Please do! Besides being a fun exercise it’s also a neat idea. Comments from the HN community make the content posted almost always more interesting imho
[1]: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...
and if you click the bookmarklet for the page that comment was discussing then their javascript will execute in your logged in context on that website.