eli submitted a report to GitHub.
Oct 1st, 2018
The X-Runtime-rack header leaks enough timing data to detect the existence of private repositories.
Steps To Reproduce:
/* | |
* Node.isConnected polyfill for EdgeHTML | |
* 2021-04-12 | |
* | |
* By Eli Grey, https://eligrey.com | |
* Public domain. | |
* NO WARRANTY EXPRESSED OR IMPLIED. USE AT YOUR OWN RISK. | |
*/ | |
if (!('isConnected' in Node.prototype)) { |
// update: this was over-engineered | |
// just navigate to an HTTP 204 redirect to exfiltrate data |
const pathFileNameMatcher = /\/?(?<fileName>[^/]+(?<fileExtension>\.[^/.]*)?)\/*$/; | |
const pathFilePrefixMatcher = /\/?(?<filePrefix>[^/]+)(?<fileExtension>\.[^/.]*)?\/*$/; | |
'test/foo/|foo|.test.enc/'.match(pathFilePrefixMatcher).groups.filePrefix == '|foo|.test' | |
const matches = new URL('https://your-url-here/example.txt').pathname.match(pathFileNameMatcher); | |
const fileName = | |
(matches && matches.groups && matches.groups.fileName) || 'file'; |
/** Alternative spreadify implementation with `...spreadify.once` */ | |
const spreadify = { | |
/** Always spread */ | |
*[Symbol.iterator](): any { | |
delete this[Symbol.iterator]; | |
yield* this.once[Symbol.iterator].call(this); | |
this[Symbol.iterator] = this.once[Symbol.iterator]; | |
}, | |
once: { | |
/** Spread once */ |
/** | |
* Get the cryptographic hash of an ArrayBuffer | |
* | |
* @param ab - ArrayBuffer to digest | |
* @param algorithm - Cryptographic hash digest algorithm | |
* @returns Hexadecimal hash digest string | |
*/ | |
export const hash = async ( | |
algorithm: string, | |
ab: ArrayBuffer | Promise<ArrayBuffer>, |
This is free and unencumbered software released into the public domain.
Anyone is free to copy, modify, publish, use, compile, sell, or distribute this software, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means.
In jurisdictions that recognize copyright laws, the author or authors of this software dedicate any and all copyright interest in the software to the public domain. We make this dedication for the benefit
This is free and unencumbered software released into the public domain.
Anyone is free to copy, modify, publish, use, compile, sell, or distribute this software, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means.
In jurisdictions that recognize copyright laws, the author or authors of this software dedicate any and all copyright interest in the software to the public domain. We make this dedication for the benefit
I hereby claim:
To claim this, I am signing this object:
// Workaround for Mozilla bug #1276438 in Firefox | |
// See https://bugzilla.mozilla.org/show_bug.cgi?id=1276438 | |
if (!Object.getOwnPropertyDescriptor(Document.prototype, "body")) | |
Object.defineProperty(Document.prototype, "body", { | |
enumerable: true | |
, configurable: true | |
, get() { | |
return this.evaluate( | |
"/*[local-name()='html'][namespace-uri()='http://www.w3.org/1999/xhtml']" | |
+ "/*[local-name()='body'][namespace-uri()='http://www.w3.org/1999/xhtml']" |