50

My friend and I were writing a question title on this site, We wanted to use an HTML tag, but we saw to our surprise that the title of the question had interpreted our HTML Tag. I was wondering if this could be a security issue for Stack Overflow?

I have not made a bug report yet as I am not sure if this is done on purpose.

As attachment, you will see a screenshot of the following line used as title:

how do I use <iframe width="560" height="315"
src="https://www.youtube.com/embed/dQw4w9WgXcQ" frameborder="0" ?
allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-
picture" allowfullscreen></iframe>

Example

9
  • 6
    Possibly XSS? What if there were script tags? This needs to be fixed ASAP
    – weegee
    Commented Aug 16, 2019 at 14:14
  • I also screen recorded the moment I found the bug, but I know no simple way to share this video. Commented Aug 16, 2019 at 15:28
  • 23
    @Anton We had a question about that last year meta.stackoverfiow.com/questions/283762/… Commented Aug 16, 2019 at 15:35
  • Sounds like you can only XSS yourself since it's while asking questions, but still...
    – Erik A
    Commented Aug 16, 2019 at 16:45
  • 8
    @FélixGagnon-Grenier That's odd -- the Stack Overfiow page redirects to YouTube.
    – S.S. Anne
    Commented Aug 17, 2019 at 2:06
  • 2
    @JL2210 Look at the domain name carefully.
    – eesiraed
    Commented Aug 17, 2019 at 5:11
  • 6
    @AlexanderZhang I know. Look at my comment carefully: Overfiow
    – S.S. Anne
    Commented Aug 17, 2019 at 14:02
  • @weegee I suspect there's no exploitable XSS hole here because I think the missing escaping is only in the question wizard, which only ever shows your own content to you (thus only allowing the user to XSS themselves). So: sloppy, but not a security hole in itself. I'm more worried that the fact that this was able to slip through the net at all (along with a similar bug in the mod tools that Cody posted about a while back and then deleted that I think really was an XSS hole) is probably a giant flashing warning sign that there are other XSS holes lurking in the codebase.
    – Mark Amery
    Commented Aug 19, 2019 at 14:10
  • @MarkAmery able to do self XSS is a big scaring point itself.
    – weegee
    Commented Aug 19, 2019 at 14:36

1 Answer 1

37

Thanks for the heads-up! This is now fixed:

an image of the wizard "similar questions" page showing no results found and the title properly escaped

2
  • 14
    I think he deserves some swag! What a catch... Commented Aug 16, 2019 at 22:21
  • 11
    This is the second instance of missing HTML escaping here I've learned of in the last few months. (The previous one was an XSS hole Cody stumbled across in the mod tools, and posted about here without appreciating its significance.) Can I suggest that it'd be a really good idea for one of you to do an audit of your codebase for XSS holes? Even spending an hour or two just doing some regex searches of your codebase for spots where values get templated/formatted/concatenated into HTML and then skimming them by eye to see if the values are escaped would probably have caught these last two bugs.
    – Mark Amery
    Commented Aug 19, 2019 at 14:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .