HexBrain

HackerOne · Report #115205

Putting link inside link in markdown

Validstatus
4upvotes
2 Apr 2016disclosed

How it was found

Hello. I was playing around in markdown editor and find 1 interesting feature. You can put a link inside link.

[  [ololo][l]   ][l]
[l]:http://dwq

If you do it [ololo][l] will be parsed first, then result of parsing will be send outside. Maximum depth of such link inserting is 16. So the slowest thing we can do is:

[[[[[[[[[[[[[[[[][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]
[l]:http://dwq

If we will add more such lines we will get error 522 from cloudflare.

Example with 522 error: https://hackerone.com/fuzopeti

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original