64

So I sent this bug report to SE by e-mail, but they told me to post it here...

It seems that anyone can create dispute ("invalid flag") flags on any post, even if they don't have the 10k "moderator tools" privileges, simply by modifying a normal "flag" link using standard developer tools in their browser. This is very easy to do:

Method A:

  1. Right-click the "flag" link.
  2. Select "inspect element" from the context menu.
  3. Change the class name from "flag-post-link" to "flag-post-link show-invalid".
  4. Click the link normally and select "it has invalid flags" in the popup that appears.

Method B:

  1. Open the JavaScript console and execute the following statement:

    $('.flag-post-link').addClass('show-invalid');

  2. Click any "flag" link on the page and select "it has invalid flags".

Turning this into a bookmarklet / user script is left as an exercise. Or you could modify this user script to work on all pages instead of just the 10k flag review page.

I have successfully used this technique to cast a dispute flag on a question here on meta, despite having only 3.5k rep here, and even though the question did not actually have any prior flags to dispute:

Screenshot

In principle, this could allow any user to dispute flags on their own posts, if they knew they had been flagged.

While I doubt this would be a very serious issue in practice, and it should be easy enough for mods / staff to detect if it happens, it would still seem a good idea to add a check to the backend so that such flags would be rejected if the flagging user doesn't have 10k privileges.

Improve this question
17
  • 4
    Plus finding bugs should always be rewarded (especially security based ones), and how can you receive your upvotes by email
    – Richard Tingle
    Commented Jan 7, 2014 at 10:28
  • 2
    So the show-invalid class is only applied if you have >10k rep, then the flagging UI shows that option only if the element has said class? I could be wrong, but the UI should load options based directly on rep, eliminating the "middleman" CSS class.
    – Trojan
    Commented Jan 7, 2014 at 10:30
  • 3
    By any chance is someone playing with this on this post, I just got an "invalid flag" on this post with no other flags; imgur.com/9KkrlaV
    – Richard Tingle
    Commented Jan 7, 2014 at 10:30
  • 2
    @RichardTingle: Wasn't me.
    – Ilmari Karonen
    Commented Jan 7, 2014 at 10:31
  • 2
    Note that you can't actually dismiss flags this way, moderator will still have to manually go over the flags and accept or decline them. However this indeed appears to be a bug, they have to run server side validation when creating that flag.
    – Shadow Wizard
    Commented Jan 7, 2014 at 10:31
  • @ShadowWizard Presumably you could lower the priority of the flag considerably though such that you "get away with" whatever you're doing for a long time
    – Richard Tingle
    Commented Jan 7, 2014 at 10:34
  • @RichardTingle "Not I," said the Trojan. Though I did add the class here, just to see for myself.
    – Trojan
    Commented Jan 7, 2014 at 10:35
  • @RichardTingle not sure, it's only one flag and I think it needs 6 to actually remove the flag from the 10K queue. It's all still not 100% clear to me though.
    – Shadow Wizard
    Commented Jan 7, 2014 at 10:37
  • 4
    @ShadowWizard But if any user can do this you could sock puppet 6 0 rep users
    – Richard Tingle
    Commented Jan 7, 2014 at 10:38
  • @ShadowWizard: AIUI, it could at least be used to deny any flag weight for the original flagger. Kind of a petty thing to do, but still, someone could do it. I'm not sure if dispute flags have any effect on, say, the VLQ review queue; if they do, that might be exploitable.
    – Ilmari Karonen
    Commented Jan 7, 2014 at 10:39
  • @RichardTingle Not quite; it would take a lot more effort than that - 15 rep per sock puppet to flag (unless the flag button can also be added via dev tools). However, your point is valid.
    – Trojan
    Commented Jan 7, 2014 at 10:40
  • 1
    @RichardTingle no doubt it's a security hole, just saying it's not really that deep of a hole.
    – Shadow Wizard
    Commented Jan 7, 2014 at 10:43
  • @trojansdestroy: Just injecting a flag link apparently does nothing useful without the JS click handler that makes it work. Didn't feel like diving into the JS code to see if I could reattach it manually. It might be easier to just fake the actual AJAX request, anyway.
    – Ilmari Karonen
    Commented Jan 7, 2014 at 10:47
  • 1
    So wait, can you cast.an "invalid flag" flag on a post that isn't even flagged to begin with? Then what would happen?
    – Doorknob
    Commented Jan 7, 2014 at 12:48
  • 2
    @DoorknobofSnow I guess we'll find out from the invalid flags on this post, I guess at some point a moderator will have a confusing day (or perhaps they will never be passed to a moderator and once it reaches 6 invalids it will just be kicked from the 10k queue)
    – Richard Tingle
    Commented Jan 7, 2014 at 13:00

1 Answer 1

Reset to default
26

Fixed in build rev 2014.1.7.1823 on meta and 2014.1.7.1277 on sites.

The POSTed data now gets validated against the list of flag types available to you. Additionally, it's now impossible to GET the popup GUI with the additional options (by using show-invalid=true) if you're not a 10k user.

Improve this answer
2
  • 7
    I guess all thats left to do now is flag the invalid flags as invalid and then validity will be restored
    – Richard Tingle
    Commented Jan 7, 2014 at 14:39
  • 3
    Umm... think you fixed it too well, user with 10048 rep now don't have that option. Did you by any chance considered 10K as literally 10K as in 1024*10 = 10240?
    – Shadow Wizard
    Commented Jan 26, 2014 at 14:01

Not the answer you're looking for? Browse other questions tagged .