13

Discussions appears to implement additional filtering on the contents of posts, in order to enforce certain additional restrictions on what can be included in posts. Unlike other forms of filtering on the site, this isn't implemented as part of the rendering process. Instead, it appears to be a filter that is applied to the markdown source of a post before it is saved. Unfortunately, this implementation is buggy and can mangle posts in unintended ways.

If I submit a post containing the following in Discussions:

I have a `<script>` tag, and I'd like to know how I need to escape
everything before the `</script>` to safely include a dynamic value.

What's actually saved is the following:

I have a `` tag, and I'd like to know how I need to escape
everything before the `` to safely include a dynamic value.

The <script> tags are removed, even though they're inert text that I'm trying to discuss.

This bug makes Discussion unsuitable for discussing HTML, but the filtering is quite lose and can affect posts that aren't even using real HTML tags. If I submit the following:

The notation a < b means that a is less than b.

What's actually saved in the following:

The notation a 

That is, the entire post following the < character is deleted, and because this is applied before the post is saved to the database, there's no way to edit the post and recover it.

This doesn’t apply to HTML tags that are normally allowed in posts; they’re not stripped.

4
  • 9
    Don't make me tap the sign! Commented Nov 29 at 20:47
  • 4
    This also lets you bypass the minimum character limit by ending your post with <123456789012345678901234567890. Commented Nov 29 at 20:50
  • 2
    It seems like the allowed tags don't get stripped (I tested with some of them and they seem to stick). Commented Nov 30 at 11:34
  • @AbdulAzizBarkat good point, edited post to reflect that Commented Nov 30 at 14:12

0

You must log in to answer this question.