In markdown, parsing things like @danlec and #46072 after links is unsafe
该报告还没有中文解读。
原文摘录
摘自原文（1177 字符中的一小部分）
(Let me preface this by saying that I haven't worked out an actual exploit for this, and there may not be one, but when #46072 is disclosed, folks will probably be taking a closer look at HackerOne's markdown parsing and may find a way to turn this bug into something)
原文中的代码
[text](http://danlec.com " @danlec ")
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 HackerOne 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @danlec · 版权归作者与 HackerOne 所有