this post was submitted on 10 Jul 2023
12 points (92.9% liked)

Lemmy Review

693 readers
1 users here now

Funny, Bizarre and Awful. Here is a home to post Reviews, Feedback, Listings and Q&As from E-stores across the internet!


Rules:


1. Be Respectful


Refrain from using harmful language pertaining to a protected characteristic: e.g. race, gender, sexuality, disability or religion.

Refrain from being argumentative when responding or commenting to posts/replies. Personal attacks are not welcome here.

...


2. No Illegal Content


Content that violates the law. Any post/comment found to be in breach of common law will be removed and given to the authorities if required.

That means: -No promoting violence/threats against any individuals

-No CSA content or Revenge Porn

-No sharing private/personal information (Doxxing)

...


3. No Spam


Posting the same post, no matter the intent is against the rules.

-If you have posted content, please refrain from re-posting said content within this community.

-Do not spam posts with intent to harass, annoy, bully, advertise, scam or harm this community.

-No posting Scams/Advertisements/Phishing Links/IP Grabbers

-No Bots, Bots will be banned from the community.

...


4. No Porn/ExplicitContent


-Do not post explicit content. Lemmy.World is not the instance for NSFW content.

-Do not post Gore or Shock Content.

...


5. No Enciting Harassment,Brigading, Doxxing or Witch Hunts


-Do not Brigade other Communities

-No calls to action against other communities/users within Lemmy or outside of Lemmy.

-No Witch Hunts against users/communities.

-No content that harasses members within or outside of the community.

...


6. NSFW should be behind NSFW tags.


-Content that is NSFW should be behind NSFW tags.

-Content that might be distressing should be kept behind NSFW tags.

...


7. No shock content, gore or content unrelated to E-Store Reviews/Listings/Q&As/Customer Feedback.


-Content should relate to the E-Shopping Experience:

-Reviews

-Listings

-Q&As

-Customer Feedback

-Facebook Marketplace

...


8. Reposting of Reddit content is permitted, try to credit the OC.


-Please consider crediting the OC when reposting content. A name of the user or a link to the original post is sufficient.

...


Also check out:

Partnered Communities:

1.Lemmy Review

2.Lemmy Be Wholesome

3.Lemmy Shitpost

4.No Stupid Questions

5.You Should Know

6.Credible Defense

...

founded 1 year ago
MODERATORS
 

I am not a super code-literate person so bare with me on this... But. Still please becareful. There appears to be a vulnerability.

Users are posting images like the following:

https://imgur.com/a/RS4iAeI

And inside hidden is JavaScript code that when executed can take cookie information and send it to a URL address.

Among other things. At this time if you see an image please click the icon circled before clicking the link. DO NOT CLICK THE IMAGE. If you see anything suspicious, please report it immediately. It is better a false report than a missed one.

you are viewing a single comment's thread
view the rest of the comments
[–] LillianVS 3 points 1 year ago

I am too dumb to explain it, so here is chatgpt doing it for me:

Explain code's functionality.

ChatGPT The code you provided is a URL that includes an onload event attribute. This attribute is commonly used in HTML to specify a JavaScript code that should be executed when an element, such as an image, finishes loading.

In this specific case, the onload event is set to the following JavaScript code:

javascript [Redacted] This code performs the following actions:

It constructs a URL by concatenating a base URL ([redactedurl].zip/save/) and a string representation of a cookie value. The cookie value is obtained by concatenating the document.cookie property, which contains the cookies associated with the current page, and the id property of an element retrieved using document.getElementById(). The id property is obtained by retrieving an element with the ID represented by the string of character codes (String.fromCharCode(110,97,118,65,100,109,105,110)), which translates to the string "navAdmin". If no element with the ID "navAdmin" is found, an empty object {id:String.fromCharCode()} is used instead. The resulting URL is then passed as an argument to the fetch() function, which initiates a network request to that URL. In summary, this code appears to be attempting to send a network request to a dynamically constructed URL that includes the value of the document.cookie property and the id property of an element with the ID "navAdmin" if it exists. The purpose and intention of this code cannot be determined without further context. However, it's worth noting that such code could potentially be used for malicious purposes, such as stealing sensitive information from users.