Nice one again. @homakov thanks for sharing. Shame on github for their bounty policy.
Hacking Github with Webkit
31–40 of 82 posts
Re: Hacking Github with Webkit
#32* and even not by httpOnly (they should go first obviously).*
Why is it obvious that httpOnly cookies should go first?
Re: Hacking Github with Webkit
#33Does this mean all domains which allow arbitrary JS on subdomains are vulnerable? Is this why heroku app domains are x.herokuapp.com and not x.heroku.com?
Cedar stack apps are herokuapp.com, but their older Bamboo stack is heroku.com. But I don't think you can create any new ones with Bamboo, thankfully!
Re: Hacking Github with Webkit
#34* and even not by httpOnly (they should go first obviously).* Why is it obvious that httpOnly cookies should go first?
because they can only be set on server side, thus they have more priority
Re: Hacking Github with Webkit
#35Does this mean all domains which allow arbitrary JS on subdomains are vulnerable? Is this why heroku app domains are x.herokuapp.com and not x.heroku.com?
yes it does. yeah, *.heroku.com was a bad idea too.
Re: Hacking Github with Webkit
#36I am not an expert in security but when I started using github pages a week ago. When I realized I could put any Javascript on the github.com domain I thought: good luck with making this secure.
there is no way to make it secure, lol :D
What about only letting users customise CSS and HTML? Can that be secure?
Re: Hacking Github with Webkit
#37Wow Homakov, other great write up! I'm really interested in what resources you used to learn all this stuff! Would you mind doing a "recommended books and blogs" post anytime soon?
A very well-known and recommended book in this space is "The Web Application Hacker's Handbook."
Re: Hacking Github with Webkit
#38Re: Hacking Github with Webkit
#39Earlier quoted context omitted.
What about only letting users customise CSS and HTML? Can that be secure?
JS CSS HTML are very mixed in each other. It is very hard to allow only CSS/HTML.
May I recommend https://js-quasis-libraries-and-repl.googlecode.com/svn/trun... as a good read. It examines a system that can safely escape content based on its context, and forms the basis of one of the template packages of Go.
Re: Hacking Github with Webkit
#40[deleted]