26

Steps to reproduce:

  • add anything that has a Description field
  • fill required fields
  • input some lorem ipsum in the Description field, then also add <a anywhere
  • save

Expected results: description saved and displayed

Actual results: description completely empty, no matter where the <a is placed

And yes, this was triggered on a legit description:

DIY temperature/humidity monitoring solution with custom built, AA battery-powered, wireless (433 MHz) nodes, with a master receiver that forwards collected data over USB, which is then persisted into a MongoDB data store. 

Migrated to attiny84 from Arduino due to prolonged battery life, from <a week to over 12+ months. ​

issue

14
  • 2
    What, exactly, is the bug? What would you expect it to do instead? Display mangled output? Just don't use unescaped HTML tags! Dec 30, 2016 at 9:56
  • 28
    I was using <a as shorthand for "less than a", I wasn't in "developer mode" :) Anyway, I think it would be better if either: it would remove just the tag, or at least give a warning that it contains invalid characters, not saving successfully and then displaying nothing at all.
    – Emil Burzo
    Dec 30, 2016 at 9:58
  • 9
    &lt;a you're welcome.
    – Cerbrus
    Dec 30, 2016 at 10:34
  • 2
    Just add a space after the angle bracket (which is not parsed as HTML anyway): "< a". < = Notice that that is not a code span and it worked fine. No HTML entities were used.
    – Waylan
    Dec 30, 2016 at 15:45
  • 13
    @CodyGray you'd expect the <a to be rendered as <a in the output just fine. The fact something is stripping it entirely suggests that someone is following the cargo cult instead of understanding XSS properly. XSS is not about what the input is, it is about the category error that is interpolating things as though they are plain text strings when in fact they are not. The coder who doesn't understand that does not understand XSS and also does not understand SQL injection, nor shell injection nor any kind of injection attack full stop.
    – user268396
    Dec 30, 2016 at 15:52
  • 1
    @user268396 - would that some be Jeff ? stackoverflow.blog/2008/06/safe-html-and-xss Dec 30, 2016 at 16:04
  • 1
    Well to be glib, his cunning plan does involve parsing HTML with regex. To be more fair: say you do trust in your whitelist, then how hard is it to properly render the rest as text (which it must be by your own definition)?
    – user268396
    Dec 30, 2016 at 17:05
  • If you want some kind of warning, there is Please block posts containing unsupported HTML?
    – Oriol
    Dec 30, 2016 at 22:07
  • 2
    Writing "less than " instead of "<" would be better. Dec 30, 2016 at 22:59
  • 1
    @user268396 As others have said, this field does accept HTML, just a limited subset, so this isn't the category error you're describing. Whether non-whitelisted HTML should be rendered as text or stripped is more of a UX concern than a security one.
    – Jeremy
    Dec 30, 2016 at 23:01
  • 3
    Note that I've marked this as by-design, since rendering broken HTML isn't really supported. That said, there's a good argument to be made here that it isn't particularly obvious that this field accepts or expects HTML (really Markdown w/ the standard subset of HTML); the only indication is that little "help" link. If you or someone else posted a feature-request that focused on this discoverability issue, I think it'd be broadly beneficial.
    – Shog9
    Dec 30, 2016 at 23:32
  • 4
    @Shog9 to me the biggest issue is not that the broken HTML doesn't display or even that it isn't obvious the field accepts HTML... it's that the entire description disappears and no effort is made to notify the user that something has gone wrong (much less what has gone wrong). Dec 31, 2016 at 2:41
  • 2
    As @Ethan says, that's quite obviously buggy behaviour, whether you set out to "support rendering broken HTML" or not. The UI should never silently nuke the user's content; period. Dec 31, 2016 at 15:44
  • 1
    Nit: this is not XSS protection, properly speaking is input validation.
    – Braiam
    Dec 31, 2016 at 18:57

1 Answer 1

6

These fields accept HTML, not text. But for security concerns, only a very strict subset of HTML is supported.

So your <a is unallowed broken HTML. Yes, maybe it could attempt to recover from the error and display surrounding text. But that would be hard to do in a safe way, and what's the point in doing that, I prefer Stack Overflow staff to invest their time improving more profitable things.

It sounds like if you prefer the fields accepted plain text instead of HTML. But then people wouldn't be able to insert links in there.

So just write proper HTML and escape < as &lt;.

4
  • 17
    The problem isn't that <a isn't displaying correctly, it's the UX issue that the whole description disappears, which coupled with the page jumping, it's very easy to miss. I've added a GIF to show you what I mean.
    – Emil Burzo
    Dec 30, 2016 at 21:39
  • 11
    I understand why you would want to accept HTML in that field and why you wouldn't want to spend a lot of time trying to build a way to recover from the error. But I do not understand why you wouldn't notify the user of the error. Dec 31, 2016 at 2:39
  • 1
    Why can't the field behave just like a SE post? (i.e. just ignore the HTML you don't process, but leave it in the source anyway.) That way, we'd know exactly what to expect, since we're used to posting stuff like that anyway.
    – Mr Lister
    Dec 31, 2016 at 16:18
  • 1
    @MrLister SE posts also remove some parts if you use invalid HTML.
    – Oriol
    Dec 31, 2016 at 17:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .