Martin Lundberg marlun

Slop

This collection is limited to only include the reports that were submitted as security vulnerabilities to the curl bug-bounty program on Hackerone.

Several other issues not included here are highly suspcious as well.

Reports

[Critical] Curl CVE-2023-38545 vulnerability code changes are disclosed on the internet. #2199174

This gist is a simple no-brainer description of the 3 ways (actually 2.5) the Web handle events.

`<tag onclick />`

The declarative inline HTML event listener is mostly an indirection of DOM Level 0 events, meaning this simply uses the equivalent of tag.onclick = listener behind the scene.

Example

click me

Toward better libraries

I am recently re-branding my libraries as µ ^(micro), refactoring these when necessary, dropping IE < 11 support, improving the logic where possible, or providing a better, more robust, or faster, API.

In few words, on the right there is the modern version of libraries I've used for the last ~5 years in production or for side projects, and I suggest anyone having one of the earlier dependencies, to have a look at their modern, micro, counterpart.

How to read these tables

All sizes are minified, brotli compressed, and representing these two files, when possible:

uce vs lit-element

A very simple comparison table between these two libraries.

	uce	lit-element
version	1.11.9	2.4.0
license	ISC (simplified MIT)	BSD-3-Clause License
language	JS w/ TS definition	TS w/ JS transpilation
size ^{_{( brotli )}}	9437b ES5 / 6811b ES2015+	8634b ES5 / 6708b ES2015+

Jest and built-in Vim features

Set up a sandbox

$ cd /tmp
$ mkdir jest-and-vim
$ cd $_
$ npm init -y
$ npm install --save-dev jest

Semantic Branch Names

See how a minor change to your branch name style can make you a better programmer.

Format: <type>/#<issueNumber>-<alias>

	---Utility for keymap creation.
	---@param lhs string
	---@param rhs string\|function
	---@param opts string\|table
	---@param mode? string\|string[]
	local function keymap(lhs, rhs, opts, mode)
	opts = type(opts) == 'string' and { desc = opts }
	or vim.tbl_extend('error', opts --[[@as table]], { buffer = bufnr })
	mode = mode or 'n'
	vim.keymap.set(mode, lhs, rhs, opts)

	function useIsPendingPathname(to) {
	let { location } = useTransition();
	let { pathname } = useResolvedPath(to);
	return location?.pathname === pathname;
	}

	function useIsSlowTransition(ms = 300) {
	let transition = useTransition();
	let [isSlow, setIsSlow] = useState(false);

	/*
	* The Knightmare Challenge (Choose your own adventure)
	* ISBN 0-552-52540-5
	*
	* Transcribed to graphviz by Kate. I had originally used record
	* nodes with ports describing each choice, but the result was
	* illegible. What a way to spend an evening.
	*/

	digraph Knightmare {

	#!/usr/bin/awk -f

	# This program is a copy of guff, a plot device. https://github.com/silentbicycle/guff
	# My copy here is written in awk instead of C, has no compelling benefit.
	# Public domain. @thingskatedid

	# Run as awk -v x=xyz ... or env variables for stuff?
	# Assumptions: the data is evenly spaced along the x-axis

	# TODO: moving average