I've recently encountered a bug on the
https://lua.org/demo.html webpage. This allows for manipulation of webpage text through the Lua compiler. I ran the code:
function a()
print(('Unnatural Lua Behavior\n'):rep(6))
end
debug.sethook(a,'c',1)
a()
This spams 'Unnatural Lua Behavior' to the output as well as overrides the message at the bottom with repetitions. This likely is open for the ability to run xss within the webpage body.
Hope y'all take care,
-Jonathan
