anyway my progress on this is that we can protopoll
23:23
from what it looks like, we can get xss here
<div>
<!-- heading/subheading text -->
{#each Object.entries($$props) as [key, value]}
{#if key === "heading"}
<h1>{value}</h1>
{:else if key === "subheading"}
<h3>{value}</h3>
{:else}
{@html value}
{/if}
{/each}
</div>
23:23
if we can protopoll something like Object.prototype.x = "<img src=x onerror=alert(1) />"
anyone have any ideas for JSON injection from this:
const generateTemplate = (arr) =>
Array.isArray(arr) &&
`{"${arr[0]}": {"${arr[1]}": {"${arr[2]}":"${arr[3]}" }}}`;
given that every element in the array goes through this:
const cleanStr = (str) => decodeURI(str).replaceAll(/[,"{}]/g, "");
