Claiming package names in GitLab's automatic package referencer.
该报告还没有中文解读。
原文摘录
摘自原文（2238 字符中的一小部分）
GitLab has a pretty neat feature that auto-links packages to their respective registry. The problem is that GitLab currently assumes that packages have been uploaded to a registry by default. For example, if no `homepage` key is pointing to GitLab in a `package.json` file, Gitlab assumes that the …
原文中的代码
<div class="blob-viewer" data-type="auxiliary"> <i aria-hidden="true" data-hidden="true" class="fa fa-cubes fa-fw"></i> This project manages its dependencies using <strong>npm</strong> and defines a package named <strong><a target="_blank" rel="noopener noreferrer" …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 GitLab 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @edoverflow · 版权归作者与 GitLab 所有