// HACKER NEWS — CYBERSECURITY
Sourcehut account takeover via build logs (XSS in ansi2html)
Welcome to my first big impact vulnerability writeup!
I like good stories, so let me describe some background first.
I recently had a ‘great’ idea (I know, I know, I should stop having these) to set up a sr.ht instance
that would pay people for hosting their projects.
You can find it shamelessly plugged in the timeline section,
in case you want to try it or flame me for it on socials.
Anyway, the story.
The first step was to clone some minimal subset of the sr.ht repos, and start hacking on it.
I tend to include the following statement in my vulnerability research submissions from this year.
Make from it what you wish.
No NLP has been used in this research. The mistakes are all mine.
SourceHut is structured in several microservices,
the main ones being meta.sr.ht and probably git.sr.ht
or hub.sr.ht (the flagship instance hosts it at just sr.ht).
And of course builds.sr.ht, the CI.
One less known is mirror.sr.ht (slowly moving to mirror.srht.network),
containing prebuilt packages for various microservices.
I must say I like this approach, because it allows a very easy start on any machine
matching the flagship instance distro version exactly.
If your favourite project currently recommends installation via curl|sudo bash
or ‘just launch Claude in this folder’ (sic!),
please consider making yourself aware of the not less valid option
of distributing software to end users using actual software packages instead.1
So if you happen to use a different distro,
or even a different version of Alpine,
you are on your own a bit.
So there is the sr.ht-apkbuilds repo,
and you can ‘fork’ it to use your signing key,
your Alpine version and your mirror.
There is also sr.ht-pkgbuilds for Arch,
but it’s effectively unmaintained at this point.2