In Stack Overflow for Teams, a user's "full name" is used instead of the "display name" that is used on the public site. The "full name" field is less restricted than the "display name" field, so it's possible for a user to it set something like this.
full name:
~/*/]]--`'"/&%\
This shouldn't be a problem, but setting a name with a trailing backslash revealed that when the name is used in a generated <script>
tag body, it is encoded as though it were being inserted into HTML text, instead of being encoded for use in an inline JavaScript string. The quote characters '"
are encoded incorrectly (as HTML entities instead of string escape sequences), and the trailing backslash is not encoded at all, causing the string literal to be unterminated, causing a syntax error that breaks some of the mod tools when viewing the user's profile page.
$('.suggested-edit-ban').click(function (e) {
StackExchange.moderator.manualSuggestedEditBan(
1, '~/*/]]--`'"/&%\');
e.preventDefault();
});
SyntaxError: '' string literal contains an unescaped line break
Best solution: stop generating script contents, in any context, ever. It's unnecessary, it's a dangerous footgun, and it prevents the use of a modern Content Security Policy.
Okay solution: use the appropriate encoding method for this context.
Bad solution: prohibit use of these incorrectly-encoded characters in names.
1
in that code snippet there. The name is just for the UI.1
represents something else.