61

So I sent this bug report to SE by e-mail, but they told me to post it here...

It seems that anyone can create dispute ("invalid flag") flags on any post, even if they don't have the 10k "moderator tools" privileges, simply by modifying a normal "flag" link using standard developer tools in their browser. This is very easy to do:

Method A:

  1. Right-click the "flag" link.
  2. Select "inspect element" from the context menu.
  3. Change the class name from "flag-post-link" to "flag-post-link show-invalid".
  4. Click the link normally and select "it has invalid flags" in the popup that appears.

Method B:

  1. Open the JavaScript console and execute the following statement:

    $('.flag-post-link').addClass('show-invalid');
    
  2. Click any "flag" link on the page and select "it has invalid flags".

Turning this into a bookmarklet / user script is left as an exercise. Or you could modify this user script to work on all pages instead of just the 10k flag review page.

I have successfully used this technique to cast a dispute flag on a question here on meta, despite having only 3.5k rep here, and even though the question did not actually have any prior flags to dispute:

Screenshot

In principle, this could allow any user to dispute flags on their own posts, if they knew they had been flagged.

While I doubt this would be a very serious issue in practice, and it should be easy enough for mods / staff to detect if it happens, it would still seem a good idea to add a check to the backend so that such flags would be rejected if the flagging user doesn't have 10k privileges.

  • 4
    Plus finding bugs should always be rewarded (especially security based ones), and how can you receive your upvotes by email – Richard Tingle Jan 7 '14 at 10:28
  • 1
    So the show-invalid class is only applied if you have >10k rep, then the flagging UI shows that option only if the element has said class? I could be wrong, but the UI should load options based directly on rep, eliminating the "middleman" CSS class. – Trojan Jan 7 '14 at 10:30
  • 3
    By any chance is someone playing with this on this post, I just got an "invalid flag" on this post with no other flags; imgur.com/9KkrlaV – Richard Tingle Jan 7 '14 at 10:30
  • 1
    @RichardTingle: Wasn't me. – Ilmari Karonen Jan 7 '14 at 10:31
  • 2
    Note that you can't actually dismiss flags this way, moderator will still have to manually go over the flags and accept or decline them. However this indeed appears to be a bug, they have to run server side validation when creating that flag. – Shadow Wizard Jan 7 '14 at 10:31
  • @ShadowWizard Presumably you could lower the priority of the flag considerably though such that you "get away with" whatever you're doing for a long time – Richard Tingle Jan 7 '14 at 10:34
  • @RichardTingle "Not I," said the Trojan. Though I did add the class here, just to see for myself. – Trojan Jan 7 '14 at 10:35
  • @RichardTingle not sure, it's only one flag and I think it needs 6 to actually remove the flag from the 10K queue. It's all still not 100% clear to me though. – Shadow Wizard Jan 7 '14 at 10:37
  • 4
    @ShadowWizard But if any user can do this you could sock puppet 6 0 rep users – Richard Tingle Jan 7 '14 at 10:38
  • @ShadowWizard: AIUI, it could at least be used to deny any flag weight for the original flagger. Kind of a petty thing to do, but still, someone could do it. I'm not sure if dispute flags have any effect on, say, the VLQ review queue; if they do, that might be exploitable. – Ilmari Karonen Jan 7 '14 at 10:39
  • @RichardTingle Not quite; it would take a lot more effort than that - 15 rep per sock puppet to flag (unless the flag button can also be added via dev tools). However, your point is valid. – Trojan Jan 7 '14 at 10:40
  • 1
    @RichardTingle no doubt it's a security hole, just saying it's not really that deep of a hole. – Shadow Wizard Jan 7 '14 at 10:43
  • @trojansdestroy: Just injecting a flag link apparently does nothing useful without the JS click handler that makes it work. Didn't feel like diving into the JS code to see if I could reattach it manually. It might be easier to just fake the actual AJAX request, anyway. – Ilmari Karonen Jan 7 '14 at 10:47
  • 1
    So wait, can you cast.an "invalid flag" flag on a post that isn't even flagged to begin with? Then what would happen? – Doorknob Jan 7 '14 at 12:48
  • 2
    @DoorknobofSnow I guess we'll find out from the invalid flags on this post, I guess at some point a moderator will have a confusing day (or perhaps they will never be passed to a moderator and once it reaches 6 invalids it will just be kicked from the 10k queue) – Richard Tingle Jan 7 '14 at 13:00
25

Fixed in build rev 2014.1.7.1823 on meta and 2014.1.7.1277 on sites.

The POSTed data now gets validated against the list of flag types available to you. Additionally, it's now impossible to GET the popup GUI with the additional options (by using show-invalid=true) if you're not a 10k user.

  • 7
    I guess all thats left to do now is flag the invalid flags as invalid and then validity will be restored – Richard Tingle Jan 7 '14 at 14:39
  • 3
    Umm... think you fixed it too well, user with 10048 rep now don't have that option. Did you by any chance considered 10K as literally 10K as in 1024*10 = 10240? – Shadow Wizard Jan 26 '14 at 14:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .