News for hackers. Stuff that matters.

A comment on Taking over your code repositories with xss.

Re:Taking over your code repositories with xss by mrspeaker on Saturday March 26, 2011 @01:15PM (#2372595)
I don't know if that guy spent months and months searching for those vectors - but casually lumping XSS attacks in all the big source control sites is a frightning thing to see.

We really need to pull back on the super-cool-awesome new feature bloat of HTML5 and get back to basics: sort this out in a meaningful way.

[ Parent | on HN ]
Re:Taking over your code repositories with xss by d1b on Saturday March 26, 2011 @10:07PM (#2373903)
I spent about around 3 hours on github(found the bugs after like 2 hours and spent another 1 playing with wiki markup --- it is sanitized don't bother), 1 hour on bitbucket, 30minutes on gitorious(obviously the bug I found was found very quickly after signing up) and ~1 1/2 hour looking at the launchpad subdomain.

I did this over like the past 100 days.

[ Parent | on HN ]