JSBeautifier BApp: Race condition leads to memory disclosure
该报告还没有中文解读。
原文摘录
摘自原文（6490 字符中的一小部分）
Description ==================== If an attacker builds up multiple connections which will be released at the same time having a response Content-Length of 0, leaving out the response Content-Length header or having a higher Content-Length than the actual response while insinuating starting a …
原文中的代码
HTTP/1.1 200 OK
Content-Length: -12000
Meta:%s:%d
Content-Type: text/html
<![a-z0-9]{1024}>默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 PortSwigger Web Security 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @jelmer · 版权归作者与 PortSwigger Web Security 所有