4 ms·
The HTML, DOC, and XLS files all have identical structure (though different content). They are all HTML, and Honey Docs is relying on Word/excel's parsing the H
by mkopinsky 13y ago
The HTML, DOC, and XLS files all have identical structure (though different content). They are all HTML, and Honey Docs is relying on Word/excel's parsing the HTML in those files to fetch the image (a 1px gif).
I downloaded the credit card Honeydoc. The content looks like:
<html>Nicole Davis 4556062729618215<br />
Brian Baker 4556767839126624<br />
Patrick Jones 4916615717158539<br />
....
<br>
<br>
<br>
....
<img src="https://honeydocs.herokuapp.com/img/html/202719bb5717d5621068780180abc593b0fedda692bd63727a510911d21fdcbf.gif">
</html>
- mkopinsky 13y agoOh, and FTR, Excel gives a warning before opening the file. So they at least have thought through this vector (if you want to call it that).