Skip to content

Instantly share code, notes, and snippets.

View oreoshake's full-sized avatar
:octocat:
I used to make it easier to develop this site securely

Neil Matatall oreoshake

:octocat:
I used to make it easier to develop this site securely
View GitHub Profile
rough match? character character's ethnicity actor actor enthnicity Birthplace
🛑 Vega Spannish Jay Tavare Native American Navajo Nation
🛑 Sagat Thai Wes Studi Cherokee Oklahoma
🛑 E. Honda Japanse Peter "Navy" Tuiasosopo Samoan USA (California)
🛑 Ryu Japanese Byron Mann Chinese Honk Kong
🛑 Bison Brazilian? Thai? British? Raul Julia Puerto Rico Puerto Rico
🛑 Blanka Brazilian Robert Mammone Australian? Australia
🛑 Zangeif Russian Andrew Bryniarski American USA
🛑 Guile American Jean Claude Van Damme Belgian Belgium
@oreoshake
oreoshake / benchmark.rb
Created January 28, 2022 07:06
Large files and ruby
require "benchmark-memory"
require "benchmark"
require "benchmark/ips"
TEST_FILE = ARGV.first
# TODO this might not be ideal but is a good start (apostrophes aren't at the beginning of a word for example, hyphens can't be at the beginning or end, there may be more punctuation to consider)
WORD_SPLIT = /[\w'-]+/
def lazy_grep
@oreoshake
oreoshake / gist:f27e3678ddca4d4a8fa9
Last active November 10, 2021 22:15
Splunk query for mixed content in CSP reports
A csp report looks like
{
"csp-report": {
"document-uri": "http://example.org/page.html",
"referrer": "http://evil.example.com/haxor.html",
"blocked-uri": "http://evil.example.com/image.png",
"violated-directive": "default-src 'self'",
"original-policy": "default-src 'self'; report-uri http://example.org/csp-report.cgi"
}
@oreoshake
oreoshake / canvas-exif-stripper.html
Created November 10, 2015 00:38
Take a file input, paint the image to a canvas, display it, read the canvas data, and POST the canvas data as an image file.
<input type="file" id="input"><br>
<img id="output">
<canvas id="canvas" style="display:none"></canvas>
<script>
// from http://stackoverflow.com/questions/19032406/convert-html5-canvas-into-file-to-be-uploaded
function uploadCanvas(dataURL) {
var blobBin = atob(dataURL.split(',')[1]);
var array = [];
for(var i = 0; i < blobBin.length; i++) {
This file has been truncated, but you can view the full file.
[
{
"id": 186,
"user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36",
"classification": "javascript_href",
"created_at": "2014-09-10T02:22:04.686Z",
"updated_at": "2014-09-10T02:22:04.686Z",
"weak_id": "1UStqNc8fKXFDV9rEtrV28TtjhbuwNpJURlvr4LKJnU=",
"report": "{\"csp-report\":{\"document-uri\":\"http://csp-inline-fingerprint.herokuapp.com/csp/javascript_href\",\"referrer\":\"http://csp-inline-fingerprint.herokuapp.com/\",\"violated-directive\":\"style-src 'none'\",\"original-policy\":\"default-src 'none'; script-src 'none'; style-src 'none'; report-uri /csp/javascript_href?id=1UStqNc8fKXFDV9rEtrV28TtjhbuwNpJURlvr4LKJnU=\",\"blocked-uri\":\"\",\"source-file\":\"chrome-extension://gighmmpiobklfepjocnamgkkbiglidom\",\"line-number\":102,\"column-number\":47,\"status-code\":200}}"
},
@oreoshake
oreoshake / stats.rb
Last active June 14, 2020 19:41
A simple script to keep tabs on an organizations use of default branches. It requires a personal access token for private repos.
# End qualified immunity
# End cash bail
# Defund the police
# Invest in addiction treatment, education, and healthcare
#
# Donate: https://www.naacpldf.org/support/fiscal-responsibility/
#
# git branch -m master main
# git push -u origin main
# Change the default branch (and updated the protected branch)
if current_user&.samesite_lax_enabled?
SecureHeaders.use_secure_headers_override(request, :samesite_lax)
end
@oreoshake
oreoshake / application_controller.rb
Last active April 20, 2020 21:51
secure_headers basic use
class ApplicationController < ActionController::Base
def add_csp_exceptions
append_content_security_policy_directives(self.class::CSP_EXCEPTIONS)
end
end
@oreoshake
oreoshake / creds.js
Last active February 28, 2020 21:21
creds = new PasswordCredential({id: username, password: "foo"})
await navigator.credentials.store(creds)
// ... then
navigator.credentials.get({
password: true,
mediation: "optional",
id: username, // no prompt or prompt with one user
})
@oreoshake
oreoshake / calendar-to-remarkable.scpt
Last active March 30, 2019 20:16
script to generate my daily calendar and send the file to my reMarkable table
# This script assumes you have set up a "Print to ReMarkable" automator print plugin script
# Follow https://github.com/juruen/rmapi/blob/master/docs/tutorial-print-macosx.md
# crontab -e and add:
# */15 * * * * osascript /path to your script.scpt >> some log file
# «class menI» Print to ReMarkable of «class menE» PDF of «class menB» PDF of window Print of «class pcap» Calendar
# You will probably run into permission errors when editing the crontab and when the job actually runs
tell application "Calendar"