My first XSS exploit, yay!

[Maciejasjmj]

Repro:

Click my usercard.

Yep.

[Kuro]

@Maciejasjmj
I'd give you a badge if I could...

Sadly there are two things preventing me.

Filed Under: Nice find, though... never clicking on a usercard ever again

[RaceProUK]

Not even eight hours, and we've found one

[Maciejasjmj]

(for the record, I totally vote to keep the <marquee> tags).

Also, two bugs for the price of one!

[Maciejasjmj]

j

[asdf]

@Maciejasjmj said:

(for the record, I totally vote to keep the <marquee> tags)

I also want gif profile backgrounds.

[asdf]

Oh, nice, we broke the parser as well.

This was the raw:

I guess that's your plugin, @ben_lubar?

[loopback0]

Superb

[Maciejasjmj]

Also, that's weird:

So... what's the title?

[loopback0]

@Maciejasjmj said:

so, that's weird:

https://what.thedailywtf.com/topic/19199/topic-title-cut-off-for-upvote-notifications/2

[aliceif]

@Maciejasjmj said:

Also, that's weird:

So... what's the title?

Upvote notifications get truncated mysteriously, it seems. There was a topic/post about it somewhere.

EDIT:

[asdf]

@aliceif Already reported as well: https://github.com/NodeBB/NodeBB/issues/4399

Who wants to report the XSS?

[Maciejasjmj]

@asdf I guess we don't want to do this on a public issue tracker?

Paging @julianlam to the courtesy phone...

[loopback0]

PM'd @julianlam and @psychobunny on community.nodebb

[julianlam]

Email security@nodebb.org and we will look into this post-haste

[blakeyrat]

Documenting for posterity:

[Maciejasjmj]

@julianlam said:

Email security@nodebb.org and we will look into this post-haste

Mail'd.

Now, off to find a way to stick a Signature Guy in...

[julianlam]

Thanks @Maciejasjmj