In this write-up, we’ll delve into how, through differential fuzzing, we uncovered a bug in Go’s exp/net HTML’s tokenizer. We’ll show potential XSS implications of this flaw. Additionally, we’ll outline how Google assessed this finding within their VRP program and guide how to engage and employ fuzzing to evaluate your software.

  • tedu@azorius.netOP
    link
    fedilink
    arrow-up
    2
    ·
    8 months ago

    I think this is a good bug find, but I don’t know why anyone would pass the original “safe” input through unchanged, instead of reserializing it.