Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Github with Webkit

homakov.blogspot.com

Post reply on HN
Print view View original

41–50 of 82 posts

Re: Hacking Github with Webkit

#41

Post by homakov »

Jabbles wrote: post #39
homakov wrote: post #38

Earlier quoted context omitted.

JS CSS HTML are very mixed in each other. It is very hard to allow only CSS/HTML.

May I recommend https://js-quasis-libraries-and-repl.googlecode.com/svn/trun... as a good read. It examines a system that can safely escape content based on its context, and forms the basis of one of the template packages of Go.

btw may behave same way!

Re: Hacking Github with Webkit

#42

Post by homakov »

Jabbles wrote: post #39
homakov wrote: post #38

Earlier quoted context omitted.

JS CSS HTML are very mixed in each other. It is very hard to allow only CSS/HTML.

May I recommend https://js-quasis-libraries-and-repl.googlecode.com/svn/trun... as a good read. It examines a system that can safely escape content based on its context, and forms the basis of one of the template packages of Go.

best xss protection - http://homakov.blogspot.com/2013/02/pagebox-website-gatekeep...

Re: Hacking Github with Webkit

#43

Post by mofle »

Oompa wrote: post #25
niggler wrote: post #2

"I reported the fixation issue privately only because I'm a good guy and was in a good mood." I for one am glad that Homakov decided to share and write about these security issues rather than just selling it to the highest bidder. I have learned quite a bit over the past year. And it's deplorable that Github isn't paying anything.

Just because a bounty policy isn't disclosed doesn't mean it doesn't exist.

I got a t-shirt some time back for reporting a serious XSS vulnerability.

Re: Hacking Github with Webkit

#45

Post by yourcelf »

Wouldn't a solution be for the server to set its session cookie for every subdomain, as HTTP-only? For example, set "_gh_sess" for every requesting domain, whether www.github.com, github.com, something.github.com; and ".github.com" as well. If you hit them all, you prevent js from shadowing them.

Re: Hacking Github with Webkit

#46

Post by beaumartinez »

homakov wrote: post #29
charliesome wrote: post #28

Earlier quoted context omitted.

I've reported several vulnerabilities to GitHub. There is no bounty policy.

yeah +1. @joernchen also did I remember. And lots of other people. Hey, anyone, is github that super profitable company with 100mln investments ? They got no money or what?

I guess people disclose enough vulns voluntarily that they don't need to offer a bounty as an incentive.

Re: Hacking Github with Webkit

#47

Post by homakov »

beaumartinez wrote: post #46
homakov wrote: post #29

Earlier quoted context omitted.

yeah +1. @joernchen also did I remember. And lots of other people. Hey, anyone, is github that super profitable company with 100mln investments ? They got no money or what?

I guess people disclose enough vulns voluntarily that they don't need to offer a bounty as an incentive.

= cheating

Re: Hacking Github with Webkit

#48

Post by homakov »

yourcelf wrote: post #45

Wouldn't a solution be for the server to set its session cookie for every subdomain, as HTTP-only? For example, set "_gh_sess" for every requesting domain, whether www.github.com, github.com, something.github.com; and ".github.com" as well. If you hit them all, you prevent js from shadowing them.

no, it's already httponly. There is NO WAY to secure your subdomains from such vuln.

Re: Hacking Github with Webkit

#50

Post by niggler »

samuelkadolph wrote: post #49

What a load of crap. The chances that github doesn't call reset_session are zero which means this doesn't work.

Given the first vulnerability, which stemmed from poor defaults in Rails and Github using said defaults, I wouldn't be surprised if it were affected by this.
Post reply on HN