One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML

An attacker with a Fizzy account can execute arbitrary same-origin JavaScript when a signed-in victim opens one crafted public-board URL. The attacker and victim do not need to share a Fizzy account.

   def pagination_link(namespace, page_number, ...)
     link_to label, url_for(params.permit!.to_h.merge(page: page_number, **url_params)), ...
   end