thibaudcolas

Latest Draftail self-XSS tester

Copy/pastable script to try out the latest version of Draftail on any Wagtail site.

⚠️ This is an XSS injection. Use at your own risk. None of the scripts loaded will alter any data, but they certainly have the power to do so.

Usage

1. Log into a Wagtail site's admin interface
2. Open the developer tools

thibaudcolas

Draftail test gist

Used on https://paper.dropbox.com/doc/Draftail-paste-test-document-njfdkwmkeGQ9KICjVwLmU.

thibaudcolas

springload/draftail#138

---

Draftail is based on Draft.js, and most of the editor's behavior (and bugs) comes from the framework. In the interest of tracking potential problems with the end product, here are Draft.js issues known to affect Draftail according to my testing.

When reporting an issue on Draftail, hopefully this issue will stand out and the work of tracking down the cause is simpler.

Draftail

thibaudcolas

Avatar component

With responsive text-only initials placeholder

Demo

thibaudcolas

Bootstrap grid tester

⚠ this relies on an XSS injection. Use at your own risk.

Copy and paste in your browser's console:

s = document.createElement('script'); s.src = 'https://rawgit.com/thibaudcolas/8a5f1afe4307354a3c547e13bd08410b/raw/ce44137409e5fce0088277bf7687a88217b9ad23/s.js'; document.querySelector('head').appendChild(s);

thibaudcolas

Sample file structure for a large-scale React + React Native codebase. All of the code of the project is under a single repository, with three sub-projects:

• server – the back-end written in Node (or whatever)
• web – the web front-end with React, Redux, React Router, Jest
• mobile – the mobile apps with React Native
• global – code that is shared between all codebases.

Folders only, then folders and files:

thibaudcolas

#!/usr/bin/env bash

# Put this in your project’s `.git/hooks`, and make it executable with `chmod +x .git/hooks/pre-commit`.

# Fail on first line that fails.
set -e

# Only keep staged files that are added (A), copied (C) or modified (M).
STAGED=$(git --no-pager diff --name-only --cached --diff-filter=ACM)
# Files which are only partly staged (eg. git add --patch).

thibaudcolas

Potential timing attack vulnerability in django-basic-auth-ip-whitelist username and password validation

• Date: 2020-04-20
• Project: django-basic-auth-ip-whitelist
• Vulnerability: Timing attack (side-channel attack)
• Severity: based on similar vulnerabilities this would be a Moderate severity, 3.7 CVSS score

Vulnerability description

Vulnerable code: baipw/utils.py#L66

thibaudcolas

Potential timing attack vulnerability in Wagtail’s password-protected private pages

• Date: 2020-04-21
• Project: wagtail
• Vulnerability: Timing attack (side-channel attack)
• Severity: based on similar vulnerabilities this would be a Moderate severity, 3.7 CVSS score

Vulnerability description

Vulnerable code: wagtail/core/forms.py#L16, in all versions from v0.8.8 onwards.

thibaudcolas

module.exports = {
  defaults: {
    headers: {
      Authorization: `Basic ${Buffer.from("username:password").toString("base64")}`,
    },
    standard: "WCAG2AAA",
    runners: ["axe", "htmlcs"],
  },
  urls: ["https://www.example.com/"],
};