A_A

Requires wrong package for firebase 9

4

# Description I've tried to use `mockFirebase`, however it always logs "Module firebase not found, mocking skipped.". The error comes from here: https://github.com/Upstatement/firestore-jest-mock/blob/45f435c8b412f7bc9bc8e8d1fac797204e387efc/mocks/firebase.js#L41-L54 It tries to `require.resolve('firebase')`, however it seems...

Permission escalation because user-uploaded html files can use session cookie

9

Edit: I've replaced localStorage from the initial comment with cookies, my initial idea that localStorage is the problem was wrong. Edit 2: Updated whole issue to say it is not...

IFrame can access mashlibs window causing XSS

8

### Summary When a user opens a html file with mashlib, this file can access the window of mashlib and thus among other things the authenticated fetch at `UI.authn.session.fetch`. ###...

### What was wrong? Nothing wrong per se. I didn't want to install all the dependencies directly on my computer (an old python version, etc.). ### How was it fixed?...

Is it theoretically possible to install this service worker with global scope (ie also for other domains)? I am thinking about doing something similar for the solid project, but I...

Cannot create_bucket with queued=True

11

When using `queued=True` the client doesn't send the create_bucket request to the server. ### Steps to reproduce: 1. Start aw-server in testing mode: `aw-server --testing --verbose` 2. Run following python...

Add traverse function

3

### Description I think that we will need to iterate recursively over all items of a folder in multiple methods, hence a common traverse method for this seems adequate. It...

I've started to look through the displacement attacks by Frontrunner Jones and got confused why the following attack got reported also by this tool. The transactions: - victim transaction: https://etherscan.io/tx-decoder?tx=0xca04cec2436f9ad5b13345da20d8b2a569bbaa8be2d4e6ba640fe6f0ff4c28e7...

Notify calls private telegram endpoint

1

The notify option calls a seemingly private API endpoint. You may want to remove this from the source code and change the endpoint (or add some kind of authentication). I...

Security considerations for integrity of solid:oidcIssuer triples

4

I am not sure if this is the correct specification, but I'd suggest to add security considerations for the write/changability of the solid:oidcIssuer triple in the WebID profile. The solid:oidcIssuer...