19

In Stack Overflow for Teams, a user's "full name" is used instead of the "display name" that is used on the public site. The "full name" field is less restricted than the "display name" field, so it's possible for a user to it set something like this.

full name: ~/*/]]--`'"/&%\

This shouldn't be a problem, but setting a name with a trailing backslash revealed that when the name is used in a generated <script> tag body, it is encoded as though it were being inserted into HTML text, instead of being encoded for use in an inline JavaScript string. The quote characters '" are encoded incorrectly (as HTML entities instead of string escape sequences), and the trailing backslash is not encoded at all, causing the string literal to be unterminated, causing a syntax error that breaks some of the mod tools when viewing the user's profile page.

$('.suggested-edit-ban').click(function (e) {
    StackExchange.moderator.manualSuggestedEditBan(
        1, '~/*/]]--`&#39;&quot;/&amp;%\');
    e.preventDefault();
});
SyntaxError: '' string literal contains an unescaped line break

Best solution: stop generating script contents, in any context, ever. It's unnecessary, it's a dangerous footgun, and it prevents the use of a modern Content Security Policy.

Okay solution: use the appropriate encoding method for this context.

Bad solution: prohibit use of these incorrectly-encoded characters in names.

7
  • Any reason why a user id isn't used? Commented May 28, 2019 at 13:53
  • 2
    Probably because the interface is designed for humans, @Tschallacka, who find display names easier to read than IDs. If I had to ban users by ID, it'd be pretty much random who got banned.
    – Cody Gray Mod
    Commented May 28, 2019 at 17:06
  • @CodyGray so you type javascript every time you ban someone? Every username has the user id baked in the user url that's usually under the name. relatively trivial to filter the user id from that url. And from user id's it's easy to find a user. Commented May 28, 2019 at 18:37
  • @CodyGray You ban based on name? What happens if you try to ban Will, which will it be: 1, 2, 3, ...? Or should I ask: Who will be the last Will? (Yeah, puns intended 😉)
    – MSeifert
    Commented May 28, 2019 at 18:48
  • 3
    The user ID is used in the actual request: it's the 1 in that code snippet there. The name is just for the UI. Commented May 28, 2019 at 18:50
  • 1
    @TorontoRaptors Thank you for the clarification. As someone without access to the moderator tools this is enlightening! I've been under the impression that the 1 represents something else.
    – MSeifert
    Commented May 28, 2019 at 18:53
  • 7
    @MSeifert It’s worked out well so far to just ban all the users named Will. Occasionally, I use some other heuristics, too, but why overcomplicate matters?
    – Cody Gray Mod
    Commented May 28, 2019 at 20:11

0

Browse other questions tagged .