Recent content on Aziz's Blog
TLDR; I found an authentication bypass in Plesk Obsidian. the admin password check uses PHP’s loose comparison (==) instead of strict (===). if the admin password looks like scientific notation (0e012345678234323232), PHP treats it as 0.0, so you can login with any string that also equals 0.0 the bug quick context - plesk has 3 types of accounts: normal users: passwords are hashed properly…
I found a context confusion in svg-sanitizer library. it sanitizes SVG for XML context (case-sensitive) but when the SVG is inlined in HTML (case-insensitive), you can bypass the filter. xlink:hReF gets through because XML is case-sensitive, but HTML doesn’t care about case, so XSS happens. the bug svg-sanitizer is used by a bunch of projects (TYPO3, CraftCMS, Contao, etc.) to clean up…
TLDR; There is a horrible lag issue with spotify, spotify didn’t fix it yet, so basically I profile the app, detect the bug slowing it down, add some code to force hardware acceleration using the translate3d(0,0,0) trick, also add some perfomance hints using willChange. before & after: The performance issue makes using spotify so horrible that I considered switching to Tidal. Spotify knows…
I’m a software person, interested in software craftsmanship and security research. I have a project portfolio over at unqualified.engineering . Currently I’m based in eu-central-1. If you’re wondering, the favicon of this site is the tunisian chechia . Contact info email: aziz at knani dot tn keys: https://github.com/realazizk.keys