Skip to content
This repository has been archived by the owner on Sep 16, 2019. It is now read-only.

XSS to RCE in preview #276

Closed
imagemlt opened this issue Sep 12, 2019 · 4 comments
Closed

XSS to RCE in preview #276

imagemlt opened this issue Sep 12, 2019 · 4 comments

Comments

@imagemlt
Copy link

imagemlt commented Sep 12, 2019 •
edited

contact me.
@imagemlt
Copy link
Author

not only calculator, we can execute any code we want.

@imagemlt imagemlt reopened this Sep 12, 2019
@yhatt
Copy link
Owner

yhatt commented Sep 13, 2019

Duplicate of #259. That's a reason why we don't recommend to use this app since a half year ago. (#267)

@yhatt yhatt mentioned this issue Sep 13, 2019
Closed
@imagemlt
Copy link
Author

but this time I can let marp execute any code I want such as pop up a Calculator.
image
I can still find way to execute scripts using nodejs api though you removed nodeintegration in the preview webview.

@yhatt
Copy link
Owner

yhatt commented Sep 14, 2019

Nice hack 🔧

Marp has no longer maintained including security update and Marp for VS Code has grown working as an alternative. thus it's a best timing for stopping published Marp apps.

@yhatt yhatt mentioned this issue Sep 14, 2019
Closed
10 tasks
@yhatt yhatt removed the duplicate label Sep 15, 2019
@FliegendeWurst FliegendeWurst mentioned this issue Jun 4, 2022
Merged
1 task
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@yhatt @imagemlt