Verify external social media meta tags about bookie HOT 2 OPEN

• XSS doesn't work
• XSS via .svg files doesn't seem to work

from bookie.

It could be possible to use links such as http://127.0.0.1, http://localhost and http://169.254.169.254. However Bookie will first check if the submitted URL is a valid URL, which will fail for IP addresses and URLs with no top level domain (e.g. .com). Even so, I added the following method to check URLs: e33e33f#diff-d38f7d5f7a2c7bcfb03b47cd27610b10R89

It should be possible to perform a DNS rebinding attack, e.g. extract meta information from the droplets internal API, http://169.254.169.254. However in the context of Digital Ocean, there doesn't seem to be any secrets that can be exposed, like in AWS.

from bookie.