Skip to content

Instantly share code, notes, and snippets.

View eligrey's full-sized avatar
:octocat:
​

Eli Grey eligrey

:octocat:
​
1.3k followers · 158 following
View GitHub Profile
@eligrey
eligrey / xpathresult-iterator.es
Last active May 8, 2024 21:23
Iterator implementations for XPathResult
// Requires ECMAScript 6
"use strict";
XPathResult.prototype[Symbol.iterator] = function* () {
let node;
switch (this.resultType) {
case XPathResult.UNORDERED_NODE_ITERATOR_TYPE:
case XPathResult.ORDERED_NODE_ITERATOR_TYPE:
while (node = this.iterateNext()) {
@eligrey
eligrey / matchCSPEntry.ts
Created May 7, 2024 19:47
matchCSPEntry screenshot
/**
* Determine if a URL matches a CSP entry data flow, using native browser CSP
* capabilities.
*
* @param cspEntry - CSP entry data flow string
* @param url - A URL to check
* @returns True if the URL matches the data flow, otherwise false
*/
export const matchCSPEntry = (cspEntry: string, url: URL): Promise<boolean> =>
new Promise((resolve) => {
@eligrey
eligrey / plagiarists.md
Last active April 23, 2024 15:54
Googlers known for plagiarism
@eligrey
eligrey / url-parse-polyfill.ts
Last active April 19, 2024 06:47
Fast URL.parse() polyfill
/**
* Fast URL.parse() polyfill
*
* Copyright (c) 2024 Transcend Inc.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
@eligrey
eligrey / airgap.js-optimized-url-parser-screenshot.ts
Created April 19, 2024 05:57
airgap.js optimized URL parser screenshot
/**
* Parses potentially stringifiable URL input into a URL instance and returns null if the input is
* an invalid URL or if the input is a data URI, as processing those uses significant resources and we
* don't need to regulate them anyway.
*
* Implemented with four tiers:
* 1. fastest: URL.parse()
* 2. second fastest: URLPattern validation + new URL()
* 3. fast for absolute URLs: DOM validation + new URL() for absolute URLs / try...catch new URL() for relative URLs
* 4. slowest: try...catch new URL()
@eligrey
eligrey / html-domparser.js
Last active April 11, 2024 10:34
DOMParser HTML extension - Now a polyfill since HTML parsing was added to the DOMParser specification
/*
* DOMParser HTML extension
* 2019-11-13
*
* By Eli Grey, http://eligrey.com
* Public domain.
* NO WARRANTY EXPRESSED OR IMPLIED. USE AT YOUR OWN RISK.
*/
/*! @source https://gist.github.com/1129031 */
@eligrey
eligrey / object-watch.js
Created April 30, 2010 01:38
object.watch polyfill in ES5
/*
* object.watch polyfill
*
* 2012-04-03
*
* By Eli Grey, http://eligrey.com
* Public Domain.
* NO WARRANTY EXPRESSED OR IMPLIED. USE AT YOUR OWN RISK.
*/
@eligrey
eligrey / github-repo-exists.js.md
Last active January 5, 2024 07:10
GitHub private repository existence disclosure timing attack

eli submitted a report to GitHub.

Oct 1st, 2018

Description:

The X-Runtime-rack header leaks enough timing data to detect the existence of private repositories.

Steps To Reproduce:

@eligrey
eligrey / example.js
Last active December 7, 2023 16:38
Execute all scripts in a document. You'll need this if you're inserting external documents.
var doc = (new DOMParser).parseFromString("<html><script>alert(1)</script></html>", "text/html");
document.replaceChild(doc.documentElement, document.documentElement);
execute_scripts(); // alert(1)
@eligrey
eligrey / leaks.md
Last active November 22, 2023 23:14
Entities that have sold or leaked my personal data

Eli's leak list

The following entities have either sold or leaked personal data about me, including email addresses and phone numbers. Be wary of sharing your data with them.

Email addresses

These entities have either sold or leaked specific unique email addresses of mine to unauthorized parties, such as spammers.