Un de vos utilisateurs pourrait alors l’installer et l’exécuter localement.

Il pourrait ensuite ouvrir un site malveillant, par exemple quelque chose comme

```
https://evilhackers.example.com
```

Et ce site malveillant enverrait des requêtes en utilisant `fetch()` avec un corps `Blob` vers l’API locale à l’adresse

```
http://localhost:8000/v1/agents/multivac

        final List<Map<String, String>> itemList = new ArrayList<>();
        final Locale locale = ComponentUtil.getRequestManager().getUserLocale();
        itemList.add(createItem(ComponentUtil.getMessageManager().getMessage(locale, "labels.webauth_scheme_basic"), Constants.BASIC));
        itemList.add(createItem(ComponentUtil.getMessageManager().getMessage(locale, "labels.webauth_scheme_digest"), Constants.DIGEST));

Joe Tsai <******@****.***> 1503699341 -0700

        final List<Map<String, String>> itemList = new ArrayList<>();
        final Locale locale = ComponentUtil.getRequestManager().getUserLocale();
        itemList.add(createItem(ComponentUtil.getMessageManager().getMessage(locale, "labels.file_auth_scheme_samba"), Constants.SAMBA));
        itemList.add(createItem(ComponentUtil.getMessageManager().getMessage(locale, "labels.file_auth_scheme_ftp"), Constants.FTP));

                                ><la:message key="labels.plugin_remote_install"/></a></li>
                                <li role="presentation" class="nav-item"><a href="#local" aria-controls="local" class="nav-link" role="tab"
                                                           data-toggle="tab"><la:message
                                        key="labels.plugin_local_install"

	for _, ep := range endpointServerPools {
		for _, endpoint := range ep.Endpoints {
			if endpoint.IsLocal {
				poolNumbers[endpoint.PoolIdx+1] = struct{}{}
			}
			nodeName := endpoint.Host
			if nodeName == "" {
				nodeName = addr
			}
			if endpoint.IsLocal {
				// Only proceed for local endpoints
				network[nodeName] = string(madmin.ItemOnline)
				continue
			}
			_, present := network[nodeName]

                    () -> asListHtml(this::saveToken));
        }

        final CurlRequest curlRequest = getCurlRequest(header);
        if (curlRequest == null) {
            final String msg = header;
            throwValidationError(messages -> messages.addErrorsInvalidHeaderForRequestFile(GLOBAL, msg), () -> asListHtml(this::saveToken));
        } else {

	String() string

	// Close closes any underlying connection to the service endpoint
	Close() error

	// Is the underlying connection online? (is always true for any local lockers)
	IsOnline() bool

	// Is the underlying locker local to this server?
	IsLocal() bool

                throwValidationError(messages -> messages.addErrorsFailedToDeleteFile(GLOBAL, form.fileName), this::asListHtml);
            }
        }).orElse(() -> {
            throwValidationError(messages -> messages.addErrorsTargetFileDoesNotExist(GLOBAL, form.fileName), this::asListHtml);
        });
        saveInfo(messages -> messages.addSuccessDeleteFile(GLOBAL, form.fileName));
        validate(form, messages -> {}, this::asListHtml);

	if err = verifyBinary(u, sha256Sum, releaseInfo, mode, bytes.NewReader(bin)); err != nil {
		peerResults[local] = madmin.ServerPeerUpdateStatus{
			Host:           local,
			Err:            err.Error(),
			CurrentVersion: Version,
		}
	} else {
		peerResults[local] = madmin.ServerPeerUpdateStatus{
			Host:           local,
			CurrentVersion: Version,
			UpdatedVersion: lrTime.Format(MinioReleaseTagTimeLayout),
		}
	}