What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 133 Stack Exchange communities.

Screenshot

The actual title of the question is: <select> in Chrome has excessive padding?

Apparently, the "notifications" tab missed the HTML escape, resulting in this. Note that this could be abused to inject a <script> tag, then anyone who comments on it (such as to say "this is spam") would be at risk of injection.

share|improve this question
3  
I thought this was abused once before when they forgot to escape it somewhere else, I think they were just changing the entire page to a picture of a unicorn, though. Oh the fun times we have on Meta. –  animuson Nov 11 '12 at 22:54
2  
@animuson It was in the hot questions list. SE has a surprising number of XSS bugs –  Yi Jiang Nov 11 '12 at 23:13

1 Answer 1

up vote 3 down vote accepted

This is fixed now. Only migration notifications weren't being properly escaped. Other types, such as badge grant notifications, were handled properly.

Useless trivia: this was the second (ever) post migrated from/to Stack Overflow with "<select>" in its title.

share|improve this answer
    
Interesting trivia. Have any had <script> in them? –  Niet the Dark Absol Nov 13 '12 at 0:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .