viewing post

hecko 3y143d (edited 3y133d) #365

this is a horrible idea

put this url in your bookmarks and click the bookmark and it'll run arbitrary code but hopefully sandboxed? it's sandboxed enough for the youtube embed to not work

(v1.1 because the previous one only did every 2nd apioid because htmlcollection bad)

javascript:void%20function(){for(var%20e=Array.from(document.getElementsByTagName(%22code%22)),t=0;t%3Ce.length;t++)e[t].innerHTML.startsWith(%22apioid\n%22)%26%26(e[t].parentNode.outerHTML='%3Ciframe%20src=%22data:text/html;base64,'+btoa((new%20DOMParser).parseFromString(e[t].innerHTML.split(%22\n%22).slice(2).join(%22\n%22),%22text/html%22).documentElement.textContent)+'%22%20style=%22'+e[t].innerHTML.split(%22\n%22)[1].replace(/%22/g,%22%26quot;%22)+'%22%20sandbox=%22allow-forms%20allow-modals%20allow-pointer-lock%20allow-scripts%22%3E%3C/iframe%3E')}();

source code so you can observe the awfulness with slightly less impedance

var elements = Array.from(document.getElementsByTagName('code'));

for (var i = 0; i < elements.length; i++) {
    if (elements[i].innerHTML.startsWith('apioid\n')) {
        elements[i].parentNode.outerHTML = '<iframe src="data:text/html;base64,' + btoa(new DOMParser().parseFromString(elements[i].innerHTML.split("\n").slice(2).join('\n'), 'text/html').documentElement.textContent) + '" style="' + elements[i].innerHTML.split("\n")[1].replace(/"/g, '&quot;') + '" sandbox="allow-forms allow-modals allow-pointer-lock allow-scripts"></iframe>'; 
    };
};

and now, to show you the power of apioids

apioid
width: 378px; height: 378px; border: 0;
<!-- https://luis.net/projects/1k/firecube/ -->
<body style="background-color: rgb(0, 0, 0); text-align: center; margin: 0;"> 
<canvas id="c" width="378" height="378"></canvas> 
<script>w=63;b=255;d=document;h=d.body.style;h.backgroundColor="#000";h.textAlign="center";C=d.getElementById("c");C.width=w*6;C.height=w*6;G=C.getContext("2d");M=Math;Q=M.max;V=13;v=-V;c=[];i=w+1;f=[i];s=0;while(i--){c[i]=i*4+",0,0)";c[i+w]=b+","+i*4+",0)";c[i+127]=b+",255,"+i*4+")";f[i]=[]}function L(l,m,n,o){k=(o-m)/(n-l);m=m-l*k;for(i=M.min(l,n);i<Q(l,n);i+=1/Q(1,M.abs(k)))f[i&b][(k*i+m)&b]=b}function D(l,m,n,o,p,q){P=[l,o];R=[m,p];S=[n,q];X=[];Y=[];for(i=0;i<2;){Z=(-P[i]*O*O-R[i]*H*O+S[i]*H)+w;X[i]=w*((-P[i]*H+R[i]*O)/Z)+(w/2);Y[i]=w*((-P[i]*O*H-R[i]*H*H-S[i++]*O)/Z)+(w/2)+7}L(X[0],Y[0],X[1],Y[1])}setInterval(function(){H=M.sin(s+=.04);O=M.cos(s);for(y=0;y<w;y++)for(x=0;x<w;x++){f[x][y]=((f[(x-1)&w][y+1]+f[x][y+1]+f[x+1][y+1]+f[x][(y+2)&w])<<5)/170;G.fillStyle="rgb("+c[f[x][y]&b];G.fillRect(x*6,y*6,6,6)}for(y=0;y<72;)eval("D("+"vvvVvvVvvVVvVVvvVvvVvvvvvvVVvVVvVVVVVVVvVVvVVvvVvvVvvvVvVVvvVVVVVvvVVvVv".substring(y,y+=6).split("")+")")},25)</script>
<body>

post source:

this is a horrible idea

put this url in your bookmarks and click the bookmark and it'll run arbitrary code but hopefully sandboxed? it's sandboxed enough for the youtube embed to not work

(v1.1 because the previous one only did every 2nd apioid because htmlcollection bad)

`javascript:void%20function(){for(var%20e=Array.from(document.getElementsByTagName(%22code%22)),t=0;t%3Ce.length;t++)e[t].innerHTML.startsWith(%22apioid\n%22)%26%26(e[t].parentNode.outerHTML='%3Ciframe%20src=%22data:text/html;base64,'+btoa((new%20DOMParser).parseFromString(e[t].innerHTML.split(%22\n%22).slice(2).join(%22\n%22),%22text/html%22).documentElement.textContent)+'%22%20style=%22'+e[t].innerHTML.split(%22\n%22)[1].replace(/%22/g,%22%26quot;%22)+'%22%20sandbox=%22allow-forms%20allow-modals%20allow-pointer-lock%20allow-scripts%22%3E%3C/iframe%3E')}();`

source code so you can observe the awfulness with slightly less impedance

```
var elements = Array.from(document.getElementsByTagName('code'));

for (var i = 0; i < elements.length; i++) {
	if (elements[i].innerHTML.startsWith('apioid\n')) {
		elements[i].parentNode.outerHTML = '<iframe src="data:text/html;base64,' + btoa(new DOMParser().parseFromString(elements[i].innerHTML.split("\n").slice(2).join('\n'), 'text/html').documentElement.textContent) + '" style="' + elements[i].innerHTML.split("\n")[1].replace(/"/g, '&quot;') + '" sandbox="allow-forms allow-modals allow-pointer-lock allow-scripts"></iframe>'; 
	};
};
```

and now, to show you the power of apioids

```
apioid
width: 378px; height: 378px; border: 0;
<!-- https://luis.net/projects/1k/firecube/ -->
<body style="background-color: rgb(0, 0, 0); text-align: center; margin: 0;"> 
<canvas id="c" width="378" height="378"></canvas> 
<script>w=63;b=255;d=document;h=d.body.style;h.backgroundColor="#000";h.textAlign="center";C=d.getElementById("c");C.width=w*6;C.height=w*6;G=C.getContext("2d");M=Math;Q=M.max;V=13;v=-V;c=[];i=w+1;f=[i];s=0;while(i--){c[i]=i*4+",0,0)";c[i+w]=b+","+i*4+",0)";c[i+127]=b+",255,"+i*4+")";f[i]=[]}function L(l,m,n,o){k=(o-m)/(n-l);m=m-l*k;for(i=M.min(l,n);i<Q(l,n);i+=1/Q(1,M.abs(k)))f[i&b][(k*i+m)&b]=b}function D(l,m,n,o,p,q){P=[l,o];R=[m,p];S=[n,q];X=[];Y=[];for(i=0;i<2;){Z=(-P[i]*O*O-R[i]*H*O+S[i]*H)+w;X[i]=w*((-P[i]*H+R[i]*O)/Z)+(w/2);Y[i]=w*((-P[i]*O*H-R[i]*H*H-S[i++]*O)/Z)+(w/2)+7}L(X[0],Y[0],X[1],Y[1])}setInterval(function(){H=M.sin(s+=.04);O=M.cos(s);for(y=0;y<w;y++)for(x=0;x<w;x++){f[x][y]=((f[(x-1)&w][y+1]+f[x][y+1]+f[x+1][y+1]+f[x][(y+2)&w])<<5)/170;G.fillStyle="rgb("+c[f[x][y]&b];G.fillRect(x*6,y*6,6,6)}for(y=0;y<72;)eval("D("+"vvvVvvVvvVVvVVvvVvvVvvvvvvVVvVVvVVVVVVVvVVvVVvvVvvVvvvVvVVvvVVVVVvvVVvVv".substring(y,y+=6).split("")+")")},25)</script>
<body>
```

i am satisfied