SourceHut account takeover via build logs (XSS in ansi2html.py)

41 points by winter 7 hours ago on lobsters | 2 comments

connor | 4 hours ago

Nice article. I'm not that knowledgeable about HTML and JavaScript so it wasn't immediately obvious to me what the trigger was in the HTML especially since <a> elements require you to click on them to do something (or so I thought.) I looked up each attribute from the reproducer, in case it's helpful to others.

  • onfocus executes JavaScript when an element gains focus.
  • autofocus specifies an element should automatically gain focus (triggering the above).
  • tabindex=1 causes the first TAB key press to focus on the element. I assume this is an additional measure in case autofocus does not pan out.

https://www.w3schools.com/jsref/event_onfocus.asp

https://www.w3schools.com/tags/att_autofocus.asp

https://www.w3schools.com/TAGS/att_tabindex.asp

mdaniel | an hour ago

It was far more confusing to me why the attributes could be delimited by / but html is 30ish years of "yeah, yeah, whatever" and that specific behavior seems to be described here https://github.com/whatwg/html/issues/11499