What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 149 Stack Exchange communities.

I just thought I'd let everyone know that I found a bug in the comments (and possibly questions as well). I went to post a comment in webmasters and I put < noscript > in it and instead of it just showing the tag, it parsed it as actual HTML. I am not sure if this can lead to XSS but I am not leaving that to doubt. Please fix this.

share|improve this question
AFAIK this is by design and very stringently whitelisted. Can you show an actual XSS attack using this? –  Pëkka Sep 21 '12 at 2:48
I can't reproduce this for comments. Also, I have a hard time believing that somebody could abuse the <noscript> tag for cross-site scripting. –  Dennis Sep 21 '12 at 2:49
<noscript>Hello, world</noscript> I can't reproduce this. I tried it on Webmasters.SE too, nothing. –  minitech Sep 21 '12 at 2:55
This is not a bug and it does not need to be fixed. There are many tags which are white listed and are not escaped. –  meagar Sep 21 '12 at 4:23
I don't believe you < noscript >. Darn, I was wrong. –  TCPMAN.EXE Sep 21 '12 at 5:20
Nope, not a single one, did my best. –  Time Traveling Bobby Sep 21 '12 at 8:04
Was it < noscript > or <noscript>? –  Time Traveling Bobby Sep 21 '12 at 8:08
what is a XSS attack.? –  Sahil Mahajan Mj Sep 21 '12 at 13:08
@SahilMahajanMj: XSS means Cross-site scripting. –  Dennis Sep 21 '12 at 13:12
+1 thanx. I used t work with android mobile platform, so never faced such a problem. –  Sahil Mahajan Mj Sep 21 '12 at 13:15

1 Answer 1

up vote 9 down vote accepted

There's no HTML allowed in comments. This includes all tags and (sadly) character references.

Since you wrote

I found a bug in the comments (and possibly questions as well).

and you used the <noscript> tag in your latest answer on Webmasters, I suppose you meant answers (not comments), you refer to the line

<noscript>Text goes here</noscript>

and you inspected the HTML code in the developer tools (or whatever it's called in your browser).

Indeed, Chrome shows the following:

  <code><noscript>Text goes here</noscript>

However, the <noscript> tag is black, meaning that's it's not an actual HTML tag (which are purple). Indeed, right-clicking the <pre> tag and choosing Edit as HTML reveals that the actual source code reads the following:

<pre><code>&lt;noscript&gt;Text goes here&lt;/noscript&gt;
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .