Skip to content

Instantly share code, notes, and snippets.

This is a crash course in JavaScript. It is intended for people who already have a bit of programming experience in other languages.

This will hopefully give a basic idea of the most-commonly-used language features, but it is not indended to be a comprehensive guide.

This guide was last updated in August 2016.

Basic syntax

To declare a variable called foo:

@not-an-aardvark
not-an-aardvark / vandalism.yml
Last active June 23, 2023 21:48
Proof-of-concept GitHub Actions workflow exploit (CVE-2021-22862)
# This is a proof-of-concept for a security bug in GitHub Actions which has since been fixed.
# See https://blog.teddykatz.com/2021/03/17/github-actions-write-access.html for more information.
# The proof-of-concept was only ever used in a test environment to validate the existence of the
# vulnerability, and is shown here for educational purposes.
#
# The proof-of-concept would have the effect of creating a `vandalism.md` file, containing vandalism,
# on the default branch of a victim repository.
#
# To use the proof-of-concept, the steps would have been:
# 1. Fork the victim repository