search

sticks-stuff / highlight-RMS-supporters

GNU General Public License v3.0
40 stars 14 forks source link

Avoid CSS hijacking #45

Closed brianloveswords closed 3 years ago

brianloveswords commented 3 years ago

This is off the top of my head (edited on github without checking out repo locally), but I did a quick test on the current link that's breaking this:

image 
> url.parse("http://github.com/augustozanellato#\"]{}*{background-image:url(\"https://camo.githubusercontent.com/e97b5645ec8c0b8eb5386cc8452df5cdb92d0b7674ea8e4a2d75506aa3beca5b/68747470733a2f2f7374616c6c6d616e2e6f72672f7361696e7469676e75636975732e6a7067\")}/*").pathname?.slice(1)
'augustozanellato'
sticks-stuff commented 3 years ago

Thank you so much, glad I didn't have to get out of bed to solve this