First, a disclaimer: this method exploits a quirk that isn’t a vulnerability, which the official team may patch at any time, breaking it. Before JH GitLab SaaS launched I already reported it to them: https://jihulab.com/gitlab-cn/saas-feedback/-/issues/10. It seems harmless enough that it was left as-is, which means we can use this non-vulnerability vulnerability to do something.
The Vulnerability That Isn’t
Let me explain how this works. Our README.md can reference images, and when other users visit, their browser fetches that image URL. So we can season the image URL — build our own analytics system, point the image at it, and every visitor passively and invisibly requests our resource.
When a user requests our resource, we as the server get their visit time, IP address (thus province and city indirectly), and browser UA.
How Baidu Analytics Works
This isn’t a post about Baidu Analytics, so I’ll cover only what’s necessary. Its code essentially uses JS to insert a fake image into our page and passes parameters through the GET request — it’s requesting this fake image URL: https://hm.baidu.com/hm.gif.
It has N parameters, but JH GitLab SaaS escapes the page to prevent XSS, so JS can’t run and most parameters can’t be captured. I’ll skip them, except for one fixed parameter, si — our Baidu Analytics site ID: https://hm.baidu.com/hm.gif?si=6eae1f418a89e09bdc11501c4774ed35
Installing Baidu Analytics on JH GitLab SaaS
Now that we understand both the quirk and the basics of Baidu Analytics, let’s combine them: reference that fake image in the project’s README.md. Here’s the Markdown syntax — HTML works too:
Just like that, whenever someone visits my project homepage, I can see it in Baidu Analytics: unique IPs, unique UAs, PVs, geographic distribution, visitor browsers, and new vs. returning visitor ratio.
Does It Work Elsewhere
Maybe you’d like to try the same trick on other platforms. Right now, though, GitHub and GitLab both rewrite image URLs referenced in README.md to their own, defeating it. Other platforms may well have this same non-vulnerability vulnerability — put it to use. Have fun.
101 Things You Want to Say About JH GitLab creator camp: https://gitlab.cn/jihulab101