Skip to content

Instantly share code, notes, and snippets.

View udhos's full-sized avatar
👾
Wondering

udhos

👾
Wondering
114 followers · 160 following
  • São Paulo, Brazil
View GitHub Profile
@zachmu
zachmu / range_iters.go
Created July 12, 2024 19:21
package main
import (
"fmt"
"io"
"iter"
"math/big"
"math/rand"
)
@motoyasu-saburi
motoyasu-saburi / lack_escape_content-disposition_filename.md
Last active November 5, 2024 19:41
Land Mine named "Content-Disposition > filename"

TL;DR

  • I found 1 browser, 1 language, and 15 vulnerabilities in { Web Framework, HTTP Client library, Email library / Web Service, etc }
  • All the vulnerabilities I found were found from a single perspective (I investigated maybe 50-80 products).
  • The RFC description of the problem (rather confusingly) describes the requirements for this problem, while the WHATWG > HTML Spec is well documented.
  • The problem is clearly targeted at the Content-Disposition fields filename and filename*.
  • This problem affects HTTP Request/Response/Email in different ways.
    • HTTP Request : request tampering (especially with file contents, tainting of other fields, etc.)
    • HTTP Response : Reflect File Download vulnerability
  • Email : Attachment tampering (e.g., extension and filename tampering and potential file content tampering)
@sanketsudake
sanketsudake / kind-kubernetes-metrics-server.md
Last active October 30, 2024 12:15
Running metric-server on Kind Kubernetes

I have created a local Kubernetes cluster with kind. Following are changes you need to get metric-server running on Kind.

Deploy latest metric-server release.

kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/download/v0.5.0/components.yaml

Within existing arguments to metric-server container, you need to add argument --kubelet-insecure-tls.

@MicahParks
MicahParks / vault_login.go
Created June 9, 2021 23:21
Golang Vault login authentication using AWS
package vault
import (
"encoding/base64"
"encoding/json"
"fmt"
"io/ioutil"
"github.com/aws/aws-sdk-go/aws/session"
"github.com/aws/aws-sdk-go/service/sts"
@fl64
fl64 / main.go
Created December 24, 2020 07:18
golang prometheus exporter example
package main
import (
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/promhttp"
"log"
"math/rand"
"net/http"
"time"
@geraldstanje
geraldstanje / README.md
Last active April 6, 2024 17:23
Call go from C++ using a shared library
@udhos
udhos / git - pushing PR changes to WIP fork
Created September 19, 2019 13:41
git - pushing PR changes to WIP fork
# how to push PR changes to a work-in-progress fork?
upstream: https://github.com/exercism/go
fork: https://github.com/udhos/go
git clone https://github.com/exercism/go ;# get upstream
cd go
git remote add fork https://github.com/udhos/go
git pull fork master ;# get changes from fork
@aliostad
aliostad / stockfish-interface.txt
Created August 17, 2019 10:41
stockfish - Description of the universal chess interface (UCI)
COPIED FROM https://build.opensuse.org/package/view_file/games/stockfish/stockfish-interface.txt?expand=1
Description of the universal chess interface (UCI) April 2006
=================================================================
* The specification is independent of the operating system. For Windows,
the engine is a normal exe file, either a console or "real" windows application.
* all communication is done via standard input and output with text commands,
@sergeyklay
sergeyklay / http-client-example.go
Last active February 19, 2024 07:52
Example usage of https://godoc.org/golang.org/x/oauth2/clientcredentials
package main
import (
"fmt"
"golang.org/x/net/context"
cc "golang.org/x/oauth2/clientcredentials"
"io/ioutil"
"net/http"
"os"
)
@shaneutt
shaneutt / LICENSE
Last active November 14, 2024 02:16
Golang: Demonstrate creating a CA Certificate, and Creating and Signing Certs with the CA
This is free and unencumbered software released into the public domain.
Anyone is free to copy, modify, publish, use, compile, sell, or
distribute this software, either in source code form or as a compiled
binary, for any purpose, commercial or non-commercial, and by any
means.
In jurisdictions that recognize copyright laws, the author or authors
of this software dedicate any and all copyright interest in the
software to the public domain. We make this dedication for the benefit