hack

telegram+github ?ref= cache poisoning

2024 Aug 22 #hack #security

Link to a github repo with a ?ref= parameter, such as https://github.com/teslamotors/ruby-smpp?ref=elon%20musk%20fucking%20sucks. The ref doesn’t need to be a valid reference in the repo (or any fork), it’s completely freetext. Then post that link somewhere on telegram. Then, anyone who posts that repo will get the ?ref parameter in the embed.

printf format validation in rust

2023 Oct 07 #hack

I was watching a talk about Idris 2 and it was mentioned that you can implement a type safe printf using dependent types (around 10 minutes in).

And I was wondering if you could do something like that in rust. And you can, ish!

error[E0308]: mismatched types
   --> src/main.rs:145:13
    |
145 |     let x = printf::<"that's a %s %s, aged %u!">("cute", "dog");
    |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ expected `"%s%s"`, found `"%s%s%u"`
    |
    = note: expected constant `"%s%s"`
               found constant `"%s%s%u"`

That’s done with no macros, just a lot of const code of dubious quality.

fun with comments

2023 Aug 14 #hack

Programming languages typically include one or two ways to comment out code so that the compiler doesn’t read it. One being line comments, such as

foo(); // comment here

which will comment out any code up until the end of the line, and the other being block comments, such as

foo(42 /* a 
    good 
    number */ )

which will comment out code in a block.

Block comments aren’t restricted to a single line, and can sometimes be nested (so that /* /* */ */ behaves correctly).

But what happens when you mix the two?

(Misusing) Python Unicode Normalisation

2020 Oct 24 #hack

After PEP 3131, python normalises identifiers in order to support non-ASCII identifiers.

That means that if you write 𝚠 = 50, where that character is U+1D6A0 MATHEMATICAL MONOSPACE SMALL W, you can later refer to that variable as w (or, indeed, anything that normalises into w).

So I wrote a program to randomly replace every character in some code with any character that normalises into it while trying not to break the program.

Custom literals in rust

2020 Sep 25 #hack

Ever wanted custom literals in rust? No? Too bad!

let x = "#123456": [[Color]];
// x is a Color

This runs at compile time. If the parser panics, you get a compile failure. Neat, huh?

This also doesn’t only work for strings. Any value known at compile time can be used. As long as you can do your processing in a const fn, it’s fair game.

Golfing rust features

2020 Aug 14 #hack

Inspired by a post about using as many language extensions as possible in haskell, I decided to make a 60*4 block of nightmares that requires as many nightly rust features to compile as possible.

I’m not expecting it to work, or even run. My benchmark was just “compile”. I managed to get 17 features in my 60 by 4 block of code. No idea if this is any good or not.