‹ BackHN Continuity

Thread

Sourcehut account takeover via build logs (XSS in ansi2html)

153 points · 29 comments · arusekk

  1. Joker_vD · · focus · HN ↗
    Oh my God, it's OSC 8 again. Because copy-pasting an URI from the terminal window is so 2003, and goodness gracious, having to look at an actual URL instead of an arbitrarily inaccurate description of it? That's, like, 1993. When I wrote my variant of ansi2html, I aggressively stripped out every C0 and C1, and all of the possible APC/DCS/OSC/PM sequences.

    Meanwhile, internal links between different parts of a man page still don't exist (unless you use GNU Info but seriously, I'd rather use lynx on a folder of HTML files instead).

    1. matja · · focus · HN ↗
      By "stripped out" I hope that means only accept colours and bold/underline and discard everything unrecognised :)
      1. Joker_vD · · focus · HN ↗
        I also accepted the inverted/standout mode, and that was actually the only slightly tricky part due to my very limited knowledge of modern CSS: in the end, I just settled on generating additional 32 classes for the inverted mode specifically. It probably could be done with CSS's local variables more elegantly, but eh.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.