URLFormJS VS t

I'm concerned about the `#` character in the URL.

# means fragment and that's kept local and not sent to the server unless client side Javascript sends it to the server. I would use an identifier that doesn't already mean something to the URL.

See https://github.com/Cyphrme/URLFormJS#query-parameters-fragme... (Also see https://github.com/Cyphrme/Path)

For an example where this is relevant: https://cyphr.me/ed25519_tool/ed.html#?msg_encoding=Text&msg...

And see https://www.rfc-editor.org/rfc/rfc3986#section-3.5

I wrote a library for storing application state in the URL. Its novel feature is using fragment query, which prevents the information from being sent to the server.

https://github.com/Cyphrme/URLFormJS

I would love to see it get more use.

Here's a small demo: https://cyphrme.github.io/URLFormJS/#?first_name=Bob&last_na...

See my other comment on this page for some other examples of its use.

Yep, it is! You can find the sources on GitLab[0]. The compression is done using brotli-wasm[1].

The entry point to the compression is the syncCompress[2] function, which converts the data to UTF-8, adds the needed header bytes, and then compresses using brotli-wasm. Decompression is done in a streaming way in streamDecompress[3]. This is to avoid zip bomb attacks, where even a short URL could decompress to gigabytes of data, locking the browser. Thankfully brotli-wasm had streaming decompression builtin, I just had to write the wrapper code to update the text content and the status bar in the UI.

You can find the brotli-wasm code I'm using in the vendor folder[4], there is a JS wrapper and then the WASM code (both are straight from brotli-wasm).

[0] https://gitlab.com/Nicd/t

[0] https://gitlab.com/Nicd/t

So I've been having a fever for this week, which turned out to be COVID. Due to that I've had a lot of time to sit around and watch TV, but also type out some silly code. In a Discord server I frequent a person wondered if it would be possible to create an anonymous pastebin that stored the contents in the URL and not on the server. I got excited to test it out and Tahnaroskakori (Finnish for the very literal translation of "pastebin") was born.

Naturally it's open source[0], and it has followed the typical trajectory of a quick hack project: it started as a clean, tiny implementation, and then adding line numbers and syntax highlighting ballooned it into a more messy state. The most challenging part was dynamically loading Prism.js highlighting when the library itself doesn't have ES module support, and I didn't want to set up a bundler tool or NPM.

Technically speaking, the pastebin contents are converted into UTF-8 bytes, then compressed using brotli, and finally encoded to the hash of the URL using a base-something alphabet. I removed some technically hash safe characters because linkifiers tend to cut off links when they encounter some of them, like ")". There is a small extensible header tacked to the front before compression, it contains the selected language for now but could contain more in the future. Though the only feature I've thought of is setting the starting line number.

URLs have a generally accepted character limit of 2048 characters (to my knowledge), so that's what is the limit for the paste. You can't really say what amount of input that corresponds to due to the brotli compression, but there are some numbers on the bottom of the page that try to help you estimate. I find it interesting to just type things and see how it affects the output length. Sometimes _adding_ a word or even a comma can cut several characters off the URL length! At very small inputs, the compressed size is bigger than the original size, making it just put the content in the URL uncompressed would be an improvement there.

If you can break or XSS it, I would be glad to know. :) I think I'll use this for my own pastebin purposes simply because it's fun and fast (and I don't need an account to use it). I don't expect it to become widely used, but I'll keep it on the GitLab page and promise not to break the hash format anymore (which is now possible to avoid thanks to the extensible header part).

I've tested it on Vivaldi, Safari, and Firefox on macOS, and quickly on Vivaldi in Android. If you have problems with it on some browser/OS, please file an issue or even better a PR. A very recent browser version is required due to usage of TransformStream[1].

[0] https://gitlab.com/Nicd/t