Did you know? There are three supported image hosts on wasteof:
i.ibb.co/*
u.cubeupload.com/*
and api.wasteof.money/*
but you can actually post images from a 4th host: https://cdn.jsdelivr.net/gh/twitter/[email protected]/assets/72x72/*
it’s the emojis on the site, but you can post them as normal images as well. Here’s an example:
i clicked it and it crashed the app (i'm on wasteof for Android)
@micahlt ^
how
micahlt makes the android app for wasteof
yeah, but for some reason clicking his name in your comment begore this one opens up my browser
oh, i didn’t even realise that. i thought that it would fail (i copied the emojis as rich text accidentally once)
i think *.tauon.dev is one too
right @lily?
nope, it’s not
i think it was going to be, but i couldn’t manage to write a motion jpeg encoder. if i do, i’ll ask jeffalo to add it again.
Sadly, this is not an XSS vector because it’s locked down to the 72×72 path, which only includes PNG images. If someone were to sneak in a malicious SVG into the Twemoji repo, though, you could possibly do it (but that would also hack thousands of other sites at the same time, including Twitter)
I think there’s also some stuff @jeffalo could do to block certain file types, but I’m not sure about that.
lol