CORS PoC - Revvity Signals Research

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_169":170,"_171":172},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_127":-5,"_20":128,"_22":129,"_130":131,"_132":133,"_25":134,"_24":-5,"_135":-5,"_136":-5,"_137":53,"_138":139,"_140":53,"_141":-5,"_142":-5,"_143":144},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","hodkasia","name","hakhjksdkdskjjds","branchName","main","version","path","","project",{"_34":72,"_13":14,"_46":73,"_74":-5,"_75":53,"_76":77,"_78":77,"_79":80,"_81":-5,"_82":83,"_84":-5,"_85":53,"_86":-5,"_87":-5,"_88":89,"_90":91,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":97,"_98":97,"_99":100,"_101":100,"_102":100,"_103":97,"_104":97,"_105":106,"_107":108,"_109":110,"_111":53},"tree",[63,64],"file","contents",[32,33],"upstream","pull","ahead","behind","envVars",{"_34":56,"_13":57,"_37":58,"_39":-5,"_40":41,"_42":59,"_44":45,"_46":60,"_17":48,"_49":24,"_50":61,"_52":53,"_54":-5,"_18":62},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":24,"_50":51,"_52":53,"_54":-5,"_18":55},"id","6815f557-13ea-49e2-ad5d-c35b7894880d","new-file-5240.html","fileId","e087cf96-8c93-11f1-b32a-1607ee4eb77e","parentId","branchId","43141556-edcb-4b50-8fe0-93be7156a649","branchVersion",7,"latest",true,"createdAt",["D",1785470263254],3,"fileType","content","\n\n\n\nCORS PoC - Revvity Signals Research\n\n\n\n\n

[!] CORS PoC — secopsh1.signalsresearch-qa.revvitycloud.net

\n\n

\n Open this file directly from disk (file://) or from any web server.
\n Be logged in to Signals Research in the same browser, then click the button.
\n This page never reads the session cookie — CORE_SESSION is HttpOnly. The browser
\n attaches it automatically because it is SameSite=None, and the server reflects
\n whatever Origin this page has (including \"null\" for file://).\n

\n\n\n show alert() popups\n\n

idle

\n\n\n\n\n","deleted",false,"label",[36],"3bd97fed-81f9-4b98-8500-5d9b77eb8fc9","main.html","dc70d150-8c93-11f1-bfd6-1607ee4eb77e",8,["D",1785470289581],"\n\n \n \n CORS PoC - Revvity Signals Research\n \n \n \n

[!] CORS PoC — secopsh1.signalsresearch-qa.revvitycloud.net

\n\n

\n Open this file directly from disk (file://) or from any web server.
\n Be logged in to Signals Research in the same browser, then click the\n button.
\n This page never reads the session cookie — CORE_SESSION is HttpOnly. The\n browser
\n attaches it automatically because it is SameSite=None, and the server\n reflects
\n whatever Origin this page has (including \"null\" for file://).\n

\n\n \n show alert() popups\n\n

idle

\n\n \n \n",[57],{"_34":56,"_13":57,"_37":58,"_39":-5,"_40":41,"_42":59,"_44":45,"_46":69,"_17":48,"_49":24,"_50":61,"_52":53,"_54":-5,"_66":70,"_18":71},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":65,"_17":48,"_49":24,"_50":51,"_52":53,"_54":-5,"_66":67,"_18":68},["D",1785470263254],"children",[],[36],["D",1785470289581],[],[57],"c6daac75-d2b7-44be-9470-cc3f3f1db4dc",["D",1785470211144],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Test","imageUrl","userId","fb0331e0-3d1a-11f0-9155-83afa7ef9de7","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","e865a235-9d7e-4e40-8d1d-575770dfd6e0","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_126":122},"org",{"_11":12,"_120":-5,"_121":122,"_82":83,"_123":124,"_125":53},"branch",{"_17":59,"_13":16,"_34":41,"_112":72,"_113":-5,"_114":-5,"_115":-5,"_116":-5,"_117":-5,"_118":14,"_119":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzJ4bnJPZkoydk8yNGRHRFY1Q3BQN3BjR084dSJ9","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_34":72,"_13":14,"_46":165,"_74":-5,"_75":53,"_76":77,"_78":77,"_79":80,"_81":-5,"_82":83,"_84":-5,"_85":53,"_86":-5,"_87":-5,"_88":89,"_90":91,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":97,"_98":97,"_99":100,"_101":100,"_102":100,"_103":97,"_104":97,"_105":166,"_107":167,"_109":168,"_111":53},[159,160],"files",[159,160],"counts",{"_149":89,"_150":151,"_152":89,"_31":153,"_154":155},[145,146],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_34":56,"_13":57,"_37":58,"_39":-5,"_40":41,"_42":59,"_44":45,"_46":60,"_17":48,"_49":24,"_50":61,"_52":53,"_54":-5,"_18":148},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":24,"_50":51,"_52":53,"_54":-5,"_18":147},[36],[57],"pulls","branches",1,"forks",{"_156":89,"_158":89},"connections",{"_156":89,"_157":89},"count","unfilledCount","emptyCount",{"_34":56,"_13":57,"_37":58,"_39":-5,"_40":41,"_42":59,"_44":45,"_46":69,"_17":48,"_49":24,"_50":61,"_52":53,"_54":-5,"_66":163,"_18":164},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":65,"_17":48,"_49":24,"_50":51,"_52":53,"_54":-5,"_66":161,"_18":162},[],[36],[],[57],["D",1785470211144],{"_11":12,"_126":122},{"_11":12,"_120":-5,"_121":122,"_82":83,"_123":124,"_125":53},{"_17":59,"_13":16,"_34":41,"_112":72,"_113":-5,"_114":-5,"_115":-5,"_116":-5,"_117":-5,"_118":14,"_119":12},"ctx",{"_105":-5,"_142":202,"_203":204,"_205":206,"_207":53,"_208":53,"_209":53,"_210":45,"_211":-5,"_212":-7,"_213":-7,"_214":89,"_215":53,"_216":53,"_217":-5,"_218":53,"_219":53,"_220":53,"_221":-5},"ENV",{"_173":174,"_175":176,"_177":16,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code