Joshua Tauberer JoshData

Potential CommonMark Exploits

This CommonMark file demonstrates some potential exploits if untrusted input is rendered with a compliant renderer. The point of this file isn't to say that CommonMark is unsafe --- the features below are very useful in many situations and are worth having in the CommonMark spec --- but that it is not safe to give untrusted input to CommonMark renderers without taking precautions.

Github doesn't render gists using CommonMark, so they won't appear as exploits below. Look at the source of this gist for the actual CommonMark.

Exploits

This link will execute a script.

This page shows a comparison of the executive orders on immigration posted on January 27, 2017 and March 6, 2017. Strikeout indicates portions deleted in the March 6 order. Underlining indicates portions added by the March 6 order. This comparison was made by GovTrack.us.

~~January 27,~~March 06, 2017

Executive Order Protecting The Nation From Foreign Terrorist Entry Into The United States

By the authority vested in me as President by the Constitution and the laws of the United States of America, including the Immigration and Nationality Act (INA), 8 U.S.C. 1101 et seq., and section 301 of title 3, United States Code, and to protect the ~~Ameri~~

	### Keybase proof

	I hereby claim:

	* I am JoshData on github.
	* I am joshdata (https://keybase.io/joshdata) on keybase.
	* I have a public key whose fingerprint is 5F4C 0E73 13CC D744 693B 2AEA B920 41F4 C10B DD81

	To claim this, I am signing this object:

	Hello and welcome to the Mail-in-a-Box setup guide. Mail-in-a-Box
	helps you take control of your email with an easy to deploy mail
	server in a box. This video tutorial will walk you through the same
	instructions that are found in the setup guide on the Mail-in-a-Box
	website. This will take you about two hours.

	Let’s say I want a new email address for myself, say, [email protected].
	I’m going to need a domain name --- that’s joshmail.xyz. And a server.
	Mail-in-a-Box configures that servers to that it provides mail server
	functionality, including support for mobile devices, webmail, spam

	# All state abbreviations for U.S. mail, from the USPS
	# Postal Addressing Standards "Publication 28," May 2015,
	# page 55.
	#
	# This list includes the 50 States, the District of Columbia,
	# Puerto Rico, island territories, and overseas military addresses.
	#
	# source:
	#
	# http://pe.usps.gov/text/pub28/28apb.htm

	# GovReady-Q Command Line YAML file describing
	# "Demo Website," a generic website, to produce
	# a System Security Plan.

	organization:
	name: Demo Agency

	app: ../govready-apps-dev/apps/generic-web-site

	questions:

	mkdir -p /etc/ssl/local \
	&& (umask 077; openssl genrsa -out /etc/ssl/local/ssl_certificate.key 2048) \
	&& openssl req -new -key /etc/ssl/local/ssl_certificate.key -out temp.csr -sha256 -subj "/CN=$HOSTNAME" \
	&& openssl x509 -req -days 365 -in temp.csr -signkey /etc/ssl/local/ssl_certificate.key -out /etc/ssl/local/ssl_certificate.crt \
	&& rm -f temp.csr

	# This bash script can be used to drop changes in your git working directory that are only changes
	# in upper/lowercase. This is useful if you are working on a case-insensitive document, such
	# as a Visual Basic 6 source code file (ugh), and your tools accidentally change the case of
	# words, but you want to revert that before making a commit. After this script finishes, your
	# working directory has your changes except for those that were only changes in case.
	#
	# This script takes the following actions:
	#
	# 1) Use "git difftool" with "diff -i" to run a case-insensitive diff on the
	# working directory and save that to a temporary patch file case_insensitive_changes.patch.

	# Pull ZIP code latitude/longitude coordinates from Geonames.org
	# and write them out to a sharded flat-file database that makes
	# it easy to efficiently query the database from the browser without
	# any backend server. The Geonames database has a CC-BY license so
	# credit must be given in the application.
	#
	# There are about 41,000 ZIP codes in the database, and with their
	# lat/lng coordinate it's about 1MB of data, which a browser could
	# load but it's kind of a lot of data for a browser to download and
	# process. With state and place names, which might make for a nicer

	/*
	* A Waveshare E-Paper controller via a simple web API
	*
	* This C++ program creates a simple HTTP server to control a Waveshare
	* e-Paper display, like the 10.3inch e-Paper e-Ink Display HAT For
	* Raspberry Pi at https://www.waveshare.com/10.3inch-e-Paper-HAT.htm
	* which I am using. This program is meant to be run on the Pi that is
	* connected to the e-Paper display.
	*
	* When run, this program creates a simple web server that serves a