4 ms·
GitLab's remediation seems a bit sketchy at best.
by nusl 1y ago
GitLab's remediation seems a bit sketchy at best.
- reddalo 1y agoThe whole "let's put LLMs everywhere" thing is sketchy at best.
- edelbitter 1y agoI wonder what is so special about onerror, onload and onclick that they need to be positively enumerated - as opposed to the 30 (?) other attributes with equivalent injection utility.
- M4v3R 1y agoThat was my thought too. They didn’t fix the underlying problem, they’ve just patched two possible exfiltration methods. I’m sure some clever people will find other ways to misuse their assistant.
- gloosx 1y agoI'm pretty sure they vibecoded the whole thing all along