Something @chrislloyd and I found in Github. Nothing too serious!
I don't think it is an exageration to say that an XSS flaw on something like github has the potential to be disasterous.
Even doing that as a prank would cause a Big Red Button security audit at some companies. As in, drop what you're doing, we need to go over every line of every commit in the git repo and verify nothing like a server password was committed. Recommendation #1 from that audit will be to stop using github.
We know that the two scenarios (ssh key injection as a prank and what happened here as a prank) are equivalent.
If a company reacts like that in your scenario but doesn't do the same after what really happened, they're doing something very wrong.
I may take out 10 minutes to have a play with that later if nobody else checks first...
[Edit: This was apparently fixed in 2009 in Firefox. http://www.mozilla.org/security/announce/2009/mfsa2009-05.ht... Again, that is just one vector -- I still think HttpOnly is likely insufficient.]
The big security hole, as alluded to above, is that Firefox (and presumably Opera) allow access to the headers through XMLHttpObject. So you could make a trivial JavaScript call back to the local server, get the headers out of the string, and then post that back to an external domain. Not as easy as document.cookie, but hardly a feat of software engineering.
http://www.codinghorror.com/blog/2008/08/protecting-your-coo...
Sess cookie for github is km_ai
_github_ses
which is the only one that's set as both httponly and secure and, by the way, doesn't appear in document.cookie
If I do an XSS attack against you on github whilst you are logged in, I can compromise all of your source repositories, your code, and in turn, potentially compromise the systems of your users.
Cute use of rickrolling btw. :-)