Poketoa @ Hyrule, Stupid!

@poketoa.bsky.social

no idea what im doing just holding this purple haired alien interface for 13 years Twitch: https://twitch.tv/poketoa Throne: https://throne.com/poketoa

Okay a tiny thread because people are going to freak out: This exploit in particular takes advantage of a special command that renders images (via attribute escape). If you have an overlay that processes images (most don't) then yes, this is your problem. Overlay must explicitly create img DOM.

A picture of the exploit, using a command that explicitly includes an image file extension, but also would escape out of the src attribute of an image such than an onerror attribute can be added to the img tag. This onerror attribute can run explicit javascript immediately.

Default behavior for most chat widgets is if you have an image it will not attempt to modify image links into actual HTML image tags. Your overlay/overlay service must explicitly be doing this for you.

It's actually really pissing me off that the Muppets special got 4 emmys, and Disney refuses to put them back on the air with an ongoing series. Wtf is their beef with Kermit?!

If you’re not seeing numbers on this thread, try updating your app or refreshing your browser!

"old video game design was better" and they literally had phone helplines you needed to call and strategy guides you needed to buy because the games were so fucking obtuse and didn't properly communicate instructions. "read the manual" maybe integrate the info into the game itself??? maybe???