Uncontrolled Resource Consumption in any Markdown field using Mermaid
该报告还没有中文解读。
原文摘录
摘自原文（3510 字符中的一小部分）
I found a bypass for the mitigation of [DoS via Mermaid (CVE-2019-9220)](https://hackerone.com/reports/470067). As the mitigation for [CVE-2019-9220](https://hackerone.com/reports/470067), the input limit of 5000 characters is currently applied to a Mermaid code block, but it can be bypassed by …
原文中的代码
System information System: Proxy: no Current User: git Using RVM: no Ruby Version: 2.6.3p62 Gem Version: 2.7.9 Bundler Version:1.17.3 Rake Version: 12.3.2 Redis Version: 3.2.12 Git Version: 2.21.0 Sidekiq Version:5.2.7 Go Version: unknown GitLab information Version: 12.1.4-ee Revision: …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 GitLab 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @ryhmnlfj · 版权归作者与 GitLab 所有