HTML class="..." injection is all you need

A while ago I implemented my own markdown parser (because obsidian has some proprietary syntax) and came about this post.

It shows how many markdown implementations add an html sanitizer then realize their code blocks require class="language-js" for the code highlighter and just allowlist the whole property without thinking.

The have a whole list of websites they exploited this on:

• Github
  

• GitLab
  

• Gitea
  

• ...

Most of the git hosting providers seem to have been affected at some point.
Of course, since I just switched to sourcehut and it wasn't on the list, I just had to give it a try.

And a few hours later...

It seems to be fixed since I emailed them about it, so here is the payload.

It is quite a bit longer than the examples given in the post (presumably because their stylesheet is a bit minimalistic).