fredericoqq

Hmm. I'm not convinced any of your routines are more "high-performance" than the standard-library, have you benchmarked them?

For example, I don't think your getorder() could possibly be faster than __builtin_ctz(), or even a wrapper around ffs(). You also hardcoded the size of size_t to 32 bits, so it's not more portable than those options.

Edit: I checked, ffs is a tiny branch-free routine in glibc:

  (gdb) disassemble ffs
   Dump of assembler code for function ffsl:
      0x0007e9d0 <+0>:	mov    $0xffffffff,%edx
      0x0007e9d5 <+5>:	bsf    0x4(%esp),%eax
      0x0007e9da <+10>:	cmove  %edx,%eax
      0x0007e9dd <+13>:	add    $0x1,%eax
      0x0007e9e0 <+16>:	ret    
   End of assembler dump.

Could you make an alert(1) or not?

If you couldn't, it's plausible the non-security developers incorrectly speculated it was possible?

I don't understand why he didn't make an alert(document.domain), the universal "this is legit" bat signal. Instead, creating some weird form phishing demo?

I think there is more to this story, it sounds like this wasn't a "Cross Site Scripting", but "Content Injection" or "Content Spoofing", a far less serious bug.

You're gonna hate me, but I would award $0 for Content Injection, it's just not a big deal ¯\_(ツ)_/¯