4 ms·
Did you fix the bug in the tixy.land code where one could inject as much code as wanted via location.hash? Here is the post from when I discovered it: https:/
by _Microft 6y ago
Did you fix the bug in the tixy.land code where one could inject as much code as wanted via location.hash?
Here is the post from when I discovered it:
https://news.ycombinator.com/item?id=24980221 https://news.ycombinator.com/item?id=24980221
Edit: no, that still works, here is an example:
https://doersino.github.io/tixyz/?code=eval(%27%2F*%27%2Bparent.location.hash)#*/Math.abs(x+y+z-t)%2-1 https://doersino.github.io/tixyz/?code=eval(%27%2F*%27%2Bpar...
- doersino 6y agoThat "bug" has become sort of a feature – the author of tixy.land added support for it a while ago [1], which I also merged into tixyz. [1]: https://twitter.com/aemkei/status/1325918933375987712 https://twitter.com/aemkei/status/1325918933375987712
- AntonyGarand 6y agoI assume he means the size of the payload remains technically below 32 while the "real" code is larger due to evaluating location.hash. `eval(location.hash.substring(1))` is 32 characters, but the hash itself can be few kilobytes I used this to merge two tixies a while back, and execute an XSS as proof of concept [0] [0] https://twitter.com/AntoGarand/status/1327101941760086017 https://twitter.com/AntoGarand/status/1327101941760086017
- _Microft 6y agoInteresting, I thought I had exhausted the list of string modification functions when checking how to work around the hash symbol. That's nicer than my solution by far.