Untitled attachment

Notices where this attachment appears

1. Embed this notice
   cohle (cohle@shitposter.club)'s status on Tuesday, 20-Sep-2022 00:20:23 JST cohle

   Since josh posted what was used for the xss attack I wanted to try it for myself.

   I basically just copied the bbcode formatter from github and put it into a small test program.

   As you can see in the video the parser does not remove html in certain cases. When using [code]...[/code] tags the text in the tag will be echoed without escaping html. When using the [img][/img] tag html added after first img will also be echoed.

   I’m not shitting on josh since I would’ve probably made similar mistakes. I guess the lesson learned is that writing a bbcode parser from scratch requires a lot of testing before it gets deployed anywhere.

   What I still don’t get is how an iframe is supposed to load html from an opus file.