Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

When I looked at the chat FAQ and clicked the link to take me to Sandbox I got this pop-up, which seems a little bit odd:

Now, when I Googled, I found a website about Stefano Palazzo, who happens to be a Stack Exchanger. When I added :9993 to the web address, I got the same pop-up.

So I ask you: What does it mean, why is it here, and is it supposed to be here?

share|improve this question
Does anyone else get this when they click the link to Sandbox? – please delete me Jan 4 '12 at 6:05
I did once, but refreshing the page, etc would not reproduce multiple times. I'd assume there's some kind of weird image URL or something on the page that someone put in there just to mess around. – animuson Jan 4 '12 at 6:10
up vote 10 down vote accepted

Stefano was illustrating a potential exploit where returning an 401 Authorization Required status for an image resource (which you can embed, say, in chat) will cause certain browsers to show the authorization dialog, which could cause some unaware user to mistakenly disclose some sort of credentials.

That message should probably be removed now that he's illustrated his point. Ideally the browser shouldn't be showing that dialog at all (Chrome started preventing the dialog from appearing in this case in May of last year), and Stefano filed a bug report for Firefox to that effect.

So, to more directly answer your question: It means that your browser is vulnerable to the exploit (if you consider it an exploit), it's there because Stefano wanted to bring it to the attention of the Stack Exchange developers, and it probably does not need to be there any longer, since the point has been proven.

share|improve this answer
Apparently it's an exploit in Safari too... – animuson Jan 4 '12 at 6:12
I see. That is good to know, because it looked a little odd to me. – please delete me Jan 4 '12 at 6:12

Stefano Palazzo posted an image that caused it to demonstrate a security vulnerability. He explained it here:

@balpha here's a security vulnerability
I can't think of a fix though (: (possibly do a HEAD on images, remove if it looks suspicious)
(this is the code, it's completely trivial:
and sorry to everyone else for the annoying pop-up

I deleted the message, so your browser won't request the image anymore and you won't get the popup

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .