Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

I just thought I'd let everyone know that I found a bug in the comments (and possibly questions as well). I went to post a comment in webmasters and I put < noscript > in it and instead of it just showing the tag, it parsed it as actual HTML. I am not sure if this can lead to XSS but I am not leaving that to doubt. Please fix this.

share|improve this question
    
AFAIK this is by design and very stringently whitelisted. Can you show an actual XSS attack using this? – Pëkka Sep 21 '12 at 2:48
3  
I can't reproduce this for comments. Also, I have a hard time believing that somebody could abuse the <noscript> tag for cross-site scripting. – Dennis Sep 21 '12 at 2:49
2  
<noscript>Hello, world</noscript> I can't reproduce this. I tried it on Webmasters.SE too, nothing. – Ryan O'Hara Sep 21 '12 at 2:55
    
This is not a bug and it does not need to be fixed. There are many tags which are white listed and are not escaped. – meagar Sep 21 '12 at 4:23
    
I don't believe you < noscript >. Darn, I was wrong. – TCPMAN.EXE Sep 21 '12 at 5:20
    
Nope, not a single one, did my best. – Time Traveling Bobby Sep 21 '12 at 8:04
    
Was it < noscript > or <noscript>? – Time Traveling Bobby Sep 21 '12 at 8:08
    
what is a XSS attack.? – Sahil Mahajan Mj Sep 21 '12 at 13:08
1  
@SahilMahajanMj: XSS means Cross-site scripting. – Dennis Sep 21 '12 at 13:12
    
+1 thanx. I used t work with android mobile platform, so never faced such a problem. – Sahil Mahajan Mj Sep 21 '12 at 13:15
up vote 10 down vote accepted

There's no HTML allowed in comments. This includes all tags and (sadly) character references.

Since you wrote

I found a bug in the comments (and possibly questions as well).

and you used the <noscript> tag in your latest answer on Webmasters, I suppose you meant answers (not comments), you refer to the line

<noscript>Text goes here</noscript>

and you inspected the HTML code in the developer tools (or whatever it's called in your browser).

Indeed, Chrome shows the following:

<pre>
  <code><noscript>Text goes here</noscript>
  </code>
</pre>

However, the <noscript> tag is black, meaning that's it's not an actual HTML tag (which are purple). Indeed, right-clicking the <pre> tag and choosing Edit as HTML reveals that the actual source code reads the following:

<pre><code>&lt;noscript&gt;Text goes here&lt;/noscript&gt;
</code></pre>
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .