Closed nahamsec closed 5 years ago
Thanks for the report! I just gave this a try but wasn't able to reproduce - just to confirm, do you get the error in safe mode as well (atom --safe
)?
Hm. Strange. Here's what my screen looked like: http://imgur.com/a/NjYHA
I just know that somehow the fuzzy finder is somehow parsing HTML when you pull it up.
This issue has been automatically closed because there has been no response to our request for more information from the original author. With only the information that is currently in the issue, we don't have enough information to take action. Please reach out if you have or find the answers we need so that we can investigate further.
Hey there,
This was a happy accident while I accidentally opened my pentest related files. Might seem interesting to you.
[Enter steps to reproduce:]
Create a file in your current folder (mine is my downloads folder) with the name
<script>alert()<%2fscript>.csv
Ctrl+T
to open up fuzzy finder. Atom: 1.15.0 x64 Electron: 1.3.13 OS: Mac OS X 10.12.3 Thrown From: fuzzy-finder package 1.4.1Stack Trace
Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".
Commands
Non-Core Packages
Screenshot:
http://imgur.com/a/NjYHA