securityMB

CSS Scrollbar attack

Image we have the following code:

<script>
var TOKEN="abcdef";
</script>

meduzen

########################### LAST UPDATE: 2018-10-03 ###########################
#                                                                             #
# Source: https://gist.github.com/meduzen/030aa314afeb4a9806c4c59994ed7ed4    #
#                                                                             #
# Main idea: target every browser with at least 0.3% market shares, plus      #
# IE 11, Safari 9 and Edge 15, no matter their shares evolution.              #
#                                                                             #
# Browserslist documentation: https://github.com/ai/browserslist#queries      #
#                                                                             #
###############################################################################

gaearon

Note:

When this guide is more complete, the plan is to move it into Prepack documentation.
For now I put it out as a gist to gather initial feedback.

A Gentle Introduction to Prepack (Part 1)

If you're building JavaScript apps, you might already be familiar with some tools that compile JavaScript code to equivalent JavaScript code:

• Babel lets you use newer JavaScript language features, and outputs equivalent code that targets older JavaScript engines.

DavidBuchanan314

B7ED7A66C80B4B008BAF7F0589C08224

All the cool kids post mysterious RNG seeds.
This isn't anything particularly useful or important, uncovered ages ago but apparently there are still 0 google search results for it.
First, I guess.

meduzen

const trackingCode = '324567890'
const postCode = 1000
const language = 'EN' // 'FR', 'NL', 'EN'

let intervalId = null
let status = null
let deliveryWindow = null

const deliveredPicApi = 'https://track.bpost.cloud/track/asset'

jonathantneal

#!/bin/sh

# Set the macOS installer path as a variable
MACOS_INSTALLER="/Applications/$(ls /Applications | grep "Install macOS")"
MOUNT_POINT="$MACOS_INSTALLER/Contents/SharedSupport"
echo "macOS installer is \"$MACOS_INSTALLER\""

# Set the target disk as a variable
TARGET=$(diskutil info "$(bless --info --getBoot)" | awk -F':' '/Volume Name/ { print $2 }' | sed -e 's/^[[:space:]]*//')
echo "Target disk is \"$TARGET\""

lpranam

What is squashing?

Squashing is a process in which we squeeze multiple commits into one pretending it is only a single commit.

Basically squashing commits means we are rewriting the history of commits to make them look like single commit.

Why squashing commits is necessary?

jakub-g

<script> async, defer, async defer, module, nomodule, src, inline - the cheat sheet

With the addition of ES modules, there's now no fewer than 24 ways to load your JS code: (inline|not inline) x (defer|no defer) x (async|no async) x (type=text/javascript | type=module | nomodule) -- and each of them is subtly different.

This document is a comparison of various ways the <script> tags in HTML are processed depending on the attributes set.

If you ever wondered when to use inline <script async type="module"> and when <script nomodule defer src="...">, you're in the good place!

Note that this article is about <script>s inserted in the HTML; the behavior of <script>s inserted at runtime is slightly different - see Deep dive into the murky waters of script loading by Jake Archibald (2013)

jakub-g

Testing double-fetching of module/nomodule JS code (including the Safari hack)

<script type="module" src="module.js"></script>
<script nomodule src="nomodule.js"></script>

Update September 2020: life's almost good. Edge Chromium is widely rolled out, and Safari 14.0 ships soon with a fix.

Test page: https://jg-testpage.github.io/es-modules/module-nomodule/

DavidKuennen

(function (context, trackingId, options) {
    const history = context.history;
    const doc = document;
    const nav = navigator || {};
    const storage = localStorage;
    const encode = encodeURIComponent;
    const pushState = history.pushState;
    const typeException = 'exception';
    const generateId = () => Math.random().toString(36);
    const getId = () => {