Discoursistent polls

[sloosecannon]

[poll]

• something?
  [quote="sloosecannon

  ---

  ---

  , post:46, topic:48459"] Quote majiks[/quote]
• yes?
  [/poll]

[loopback0]

Someone else voted and...

[sloosecannon]

Quotes apparently asplode polls...

@sloosecannon

[poll] -foo -foo2 [/poll]

, post:46, topic:48459 said:

Quote majiks

And trying to use quote majiks asplode polls and quotes too

[sloosecannon]

[poll]

• option

option2

---

• HI!
  [/poll]

That's fantastic

[Onyx]

[poll]

• option

[poll]

• option

option2
[/poll]

That's fantastic
[/quote]

Damn it, baking "fixes" it

[sloosecannon]

[poll name=
]

• hello
• world

[poll]

• hello world?
• Hello!
  [/poll]
• hello world!
  [/poll]

[sloosecannon]

LOL WTF?

Copy raw to see what I thought it would look like

[Yamikuronue]

...where did "hello world!" even go?

[sloosecannon]

Good question.

[sloosecannon]

Also, XSS achieved

[ChaosTheEternal]

[poll]

• small
• 

[/poll]

Damn max height. To be nice, I'll shrink the image some.

[sloosecannon]

[poll]

• Vote

• Vote here
  
  [/poll]

[tarunik]

[poll]

• outer option
• dummy [poll name=flargle]
• inner option
• another inner option
• more dumminess [poll name=blargle]
• an inner inner option
• another inner inner option
• breakage [/poll]
• [/poll]
  [/poll]
  Alright -- I can create nested polls in preview (show raw for how), but they Discobake to one poll. Interesting...

[sloosecannon]

I can create nested polls

[poll name=outer]

• 1
• <script>alert("hi!")</script>Foo!
• 2
• 3

- 4 [/poll]

No, they don't behave anywhere near what you'd expect them to. Not sure what to expect in the first place though...

[sloosecannon]

[quote="

Foo!

[ben_lubar]

Shit, I thought those were screenshots. But they're actual polls. What?

[tarunik]

]

• an option
• another option
  [/poll]

[sloosecannon]

What was your intent, and did you succeed?

[tarunik]

[poll name=<script>=lert("uh oh");</script>]

• an option
• another option
  [/poll]

[tarunik]

[poll name=<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>]

• an option
• another option
  [/poll]

[tarunik]

[poll name="style=&{alert('XSS')]

• an option
• another option
  [/poll]

[tarunik]

[poll name="]

• an option
• another option
  [/poll]

[sloosecannon]

Heh you're really trying hard, aren't you?
You're aware I already found something right? :P

[tarunik]

[poll name="style=brouhaha"]

• an option
• another option
  [/poll]

[tarunik]

[poll name="&>>&<<script&>>]

• an option
• another option
  [/poll]

[tarunik]

[poll name="<>&<;<script>alert("ohno");//&<</script&>>]

• an option
• another option
  [/poll]

[tarunik]

[poll name="&>>&<<script>alert("ohno");//&<</script&>>]

• an option
• another option
  [/poll]

[tarunik]

[poll name="<>�<script>alert("ohno");//&<</script&>>]

• an option
• another option
  [/poll]

[tarunik]

[poll name="<><<script>alert("ohno");//<</script>&lt:<div ]

• an option
• another option
  [/poll]

[ben_lubar]

@accalia said:

if it's broken our customers will tell us!

My users tell me that the program is really great and then I look at what they're doing and my program is doing something really stupid and broken in response to their actions. Like throwing them down an elevator shaft because they pressed against a wall.

[tarunik]

[poll name="<=]

• an option
• another option
  [/poll]

[tarunik]

[poll name="&>>&<<script>alert("ohno");//&<</script&>>]
- an option
- another option
[/poll]

This is the closest I've come to an XSS so far -- the Discobaker actually gets fooled into letting the tags into the cooked post, but Chrome's parser gets lost in the swamp of bogus entities and doesn't see them.

[ben_lubar]

[poll name=]

• ­
• ­
• ­ ­
• ­ ­
• ­ ­ ­
• ­ ­ ­
  [/poll]

[sloosecannon]

Nope... I've been bitten by that issue before. Chrome's dev-view display "helpfully" turns html entities into the proper characters, hiding the fact that everything's actually escaped :P

[tarunik]

@sloosecannon said:

Chrome's dev-view display "helpfully" turns html entities into the proper characters, hiding the fact that everything's actually escaped

Oh...laughs silly dev display

[sloosecannon]

Yup, been there, stupided that, got the T-shirt

[accalia]

@ben_lubar said:

@accalia said:

if it's broken our customers will tell us!

My users tell me that the program is really great and then I look at what they're doing and my program is doing something really stupid and broken in response to their actions. Like throwing them down an elevator shaft because they pressed against a wall.

they're not complaining though so: WONTFIX-NOREALUSERCOMPLAINT

:-P

[boomzilla]

@ben_lubar said:

My users tell me that the program is really great and then I look at what they're doing and my program is doing something really stupid and broken in response to their actions. Like throwing them down an elevator shaft because they pressed against a wall.

Sounds like they're afraid of what you'll do to them if they actually complained.

[Onyx]

I can haz big texts? Let's see if this renders like preview claims it will!

[Onyx]

<script>alert("xss?");</script>

• Hello
• <script>alert(xss?);

[aliceif]

I can't decide!

[Onyx]

<script>alert("xss?");</script>

• Hello
• There<script>alert('xss?');</script>

I wonder...

[Onyx]

Damn, can't hijack another poll... Also it hides all content after the poll.

Edit: no, that was me doing something wrong, content is there

[Onyx]

Ok, last one because I forgot to test this:

Pick one! Really. Oh come on already. ```

• Hello
• There</script>

View raw for extra WTFery. Copy and remove backticks for bonus mindfuck.

[riking]

The height: 2.3em style is removed in master, which will remove the signature guy shenanigans. Though it should probably be min-height: 2.3em; ping @zogstrip

[nexekho]

This is great. Takes me right back to the Community Server days.