CSRF volnurability in search-data about hugo-geekdoc

[edruid]

I don't actually have a good resource... But the issue is easy enough to test: in a test environment (on a different domain than geekdocs.de) change the loadScript for the search data to use the demo sites data: https://geekdocs.de/js/en.search-data.min.117b1c7d3df6007e36fb3e6e137875a00134205b7aceeae7ac39abdfa5a77399.js

The CORS rules actually applies in that you cannot read the javascript code, but the script is run and the data is stored in window.geekdocSearchIndex which is available to a nefarious site.

This type of attack was once successful in downloading users contacts from gmail once upon a time (~2006 or so) but I couldn't find a good writup on it...

[edruid]

I might be able to make a pull request with changes, but I'm not fluent with either hugo templates or javascript. But if nothing else it might serve as an idea.

[xoxys]

Thanks for your report. Do you have a link for some background? I can't see how/why JavaScript files are excluded from CORS rules.

[xoxys]

Related upstream issue nextapps-de/flexsearch#205

[xoxys]

Thanks for adding the details. I need to take a look how to handle this with a JSON file...