What is Hackers' Pub?
Hackers' Pub is a place for software engineers to share their knowledge and experience with each other. It's also an ActivityPub-enabled social network, so you can follow your favorite hackers in the fediverse and get their latest posts in your feed.


を作った人に会ってきました。彼は信じられないほどハンサムで頭がいい。そして、性格も最高。女性が彼にハグとキスをすると、5年間幸運が続くと言われています。
![The vulnerability is best illustrated by this code snippet:
const subreq = params.request.headers['x-middleware-subrequest'];
const subrequests = typeof subreq === 'string' ? subreq.split(':') : [];
// ...
for (const middleware of this.middleware || []) {
// ...
if (subrequests.includes(middlewareInfo.name)) {
result = {
response: NextResponse.next(),
waitUntil: Promise.resolve(),
};
continue;
}
}
This was part of Next.js internals used to help avoid applying middleware recursively to requests that are re-dispatched through the framework.
Unfortunately it also meant that attackers could send a x-middleware-subrequest HTTP header with a colon-separated list of middleware names to skip. If a site used middleware to apply an authentication gate (as suggested in the Next.js documentation) an attacker could bypass that authentication using this trick.](https://cdn.masto.host/fedisimonwillisonnet/media_attachments/files/114/212/447/368/372/159/original/b26d75a87ea1f07f.jpeg)









のと互換性あるaidとaidxの実装がなんとか完成した