In this write-up, we’ll delve into how, through differential fuzzing, we uncovered a bug in Go’s exp/net HTML’s tokenizer. We’ll show potential XSS implications of this flaw. Additionally, we’ll outline how Google assessed this finding within their VRP program and guide how to engage and employ fuzzing to evaluate your software. Introduction Reminisce with me the discussion boards of 2005. Open to all, searchable from every corner, with no account needed to peek in.

In this write-up, we’ll delve into how, through differential fuzzing, we uncovered a bug in Go’s exp/net HTML’s tokenizer. We’ll show potential XSS implications of this flaw. Additionally, we’ll outline how Google assessed this finding within their VRP program and guide how to engage and employ fuzzing to evaluate your software.

  • tedu@azorius.netOP
    2·
    1 year ago

    I think this is a good bug find, but I don’t know why anyone would pass the original “safe” input through unchanged, instead of reserializing it.