Found a DOMPurify 3.2.3 Bypass on Chinese New Year! Works when `SAFE_FOR_TEMPLATES` is set to true.

Recently participated in x3CTF and LA CTF with Black Bauhinia, here are writeups to some challenges I found quite interesting: x3CTF blogdog(DOMPurify quirk + CSS exfil): LA CTF antisocial(.replace XSS + weird cookie manipulation):

RT @arkark_: 今年最初のCVE

@kevin_mizu Very well deserved! The motivation for my recent DOMPurify bypass stemmed from your post :) Congratulations and keep up the great work!

RT @XssPayloads: DOMPurify 3.2.3 Bypass (Non-Default Config), by @ensyzip

RT @ensyzip: Found a DOMPurify 3.2.3 Bypass on Chinese New Year! Works when `SAFE_FOR_TEMPLATES` is set to true. ht…

@quantizor hey could you dm me, I've found a security problem in one of your projects

RT @deno_land: #FreeJavaScript update: Oracle has informed us they won’t voluntarily withdraw their trademark on "JavaScript". Next: they’l…

golang 新手日常一 要export嘅variable名頭嗰個字唔小心寫咗細楷 debugging time: 1 hr

HKCERT CTF 2024 Qualifiers web/JSPyaml writeup !! quite a fun task

@dy_xiaodong you will find out @ finals :)

@dy_xiaodong so strong secondary school student play open division 😭

RT @AlpacaHack: Round 2 (Web) just ended 🦙 Thank you to all the players who participated! Congratulations to the top 5 players: 1. icesfon…