HackerOne · Report #115205
Putting link inside link in markdown
Validstatus
4upvotes
2 Apr 2016disclosed
How it was found
Hello. I was playing around in markdown editor and find 1 interesting feature. You can put a link inside link.
[ [ololo][l] ][l]
[l]:http://dwq
If you do it [ololo][l] will be parsed first, then result of parsing will be send outside.
Maximum depth of such link inserting is 16.
So the slowest thing we can do is:
[[[[[[[[[[[[[[[[][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]][l]
[l]:http://dwq
If we will add more such lines we will get error 522 from cloudflare.
Example with 522 error: https://hackerone.com/fuzopeti