thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

WebReflection

This gist is a simple no-brainer description of the 3 ways (actually 2.5) the Web handle events.

<tag onclick />

The declarative inline HTML event listener is mostly an indirection of DOM Level 0 events, meaning this simply uses the equivalent of tag.onclick = listener behind the scene.

Example

click me

marcamos

const navButtonEl = '[aria-controls^="nav-menu-"]';
const navMenuEl = '[id^="nav-menu-"]';
const navButtons = Array.from(document.querySelectorAll(navButtonEl));
const navMenus = Array.from(document.querySelectorAll(navMenuEl));
const closeNavMenu = () => {
	navButtons.forEach(button => {
		button.setAttribute('aria-expanded', false);
	});
	navMenus.forEach(menu => {
		menu.hidden = true;

eliotharper

<script language="javascript" runat="server">
// Author: Eliot Harper <eliot@eliot.com.au>
// Revision date: January 31, 2021

// DISCLAIMER
// While due care has been taken in the preparation of this
// supplied code example, no liability is assumed for incidental
// or consequential damages in connection with or arising out its 
// use. Example code is provided on an "as is" basis and no 
// expressed or implied warranty of any kind is made for the 

LuigiClaudio

import { useEffect } from 'react';
import { get } from 'lodash';
import { navigate } from 'gatsby';
import { useLoading } from '@luigiclaudio/ga-baseline-ui/helpers';
import { Identity } from '@luigiclaudio/ga-auth-theme';

const useUser = () => {
    const { user, getFreshJWT, logoutUser } = Identity.useIdentityContext();
    const [isLoading, load] = useLoading();
    const tokenObject = get(user, 'token');

soerenmartius

import {
  ActionContext,
  ActionTree,
  GetterTree,
  MutationTree,
  Module,
  Store as VuexStore,
  CommitOptions,
  DispatchOptions,
} from 'vuex'

mohokh67

const formatedTimestamp = ()=> {
  const d = new Date()
  const date = d.toISOString().split('T')[0];
  const time = d.toTimeString().split(' ')[0].replace(/:/g, '-');
  return `${date} ${time}`
}

wvpv

%%[

var @contextInsertDate

set @contextInsertDate = AttributeValue("YOUR_TSD_DE_INSERT_DATE")
set @contextInsertDate = format(@contextInsertDate,"yyyyMMddhhmmss")

var @exclude
set @exclude = 0

marcamos

// Use #1: <img> element using src and srcset:
// <img data-lazy-srcset="/path/to/image-2x.jpg 2x"
//      data-lazy-src="/path/to/image-1x.jpg"
//      alt="TODO" width="TODO" height="TODO" loading="lazy" />
//
// Use #2: <img> element using src, srcset, and sizes:
// <img data-lazy-srcset="your srcset list here"
//      data-lazy-src="/path/to/image.jpg"
//      sizes="your sizes list here"
//      alt="TODO" width="TODO" height="TODO" loading="lazy" />

eddiewebb

Client side searching for Hugo.io with Fuse.js

• WHY
• Sample
• Setup
• Files
  • content/search.md
  • layouts/_default/search.html
  • static/js/search.js

• layouts/_default/index.json