Tessera
Folgen

Joel Margolis (teknogeek)

@teknogeek.io

hacker

2 Posts3531 Follower143 Folgt
Justin Gardner@rhynorater.bsky.social · 2y ago

Yo, new big thing: Shift. AI seamlessly integrated into your HTTP proxy. Use cases: "Take this JS and build the JSON request body" "Fill in these IDs from my notes - UserA" "Create a match and replace rule to turn on this feature flag" "Generate a wordlist with all HTTP Verbs"

Johan Carlsson@joaxcar.bsky.social · 2y ago

Specification challenge! ☃️ Which (if any) of the href values (1-5) would pop an alert in this scenario? 🛑 No testing, just thinking! ⚠️ Warning: answers in comments (bonus: why/why not)

let wrapper = document.createElement("div") document.body.append(wrapper) let anchor = document.createElement("a") /*1*/ anchor.href = "//<style onload=alert()>" /*2*/ anchor.href = "<style onload=alert()>" /*3*/ anchor.href = "https://a.a/<style onload=alert()>" /*4*/ anchor.href = "https://a.1/<style onload=alert()>" /*5*/ anchor.href = "a:<style onload=alert()>" wrapper.innerHTML = anchor.href