53

So, after I figured out that I could see who starred a message (highly related), I figured I might be able to find out the flagger of a message too. So I tried. Here's some data from my logs:

hichris is about to flag

{"event_type"=>1, "time_stamp"=>1398388054, "content"=>"Flag now?", "id"=>28079239, "user_id"=>10308
1, "user_name"=>"hichris123", "room_id"=>11540, "room_name"=>"Charcoal HQ", "message_id"=>15148938}
{"event_type"=>1, "time_stamp"=>1398388055, "content"=>"k", "id"=>28079240, "user_id"=>103081, "user
_name"=>"hichris123", "room_id"=>11540, "room_name"=>"Charcoal HQ", "message_id"=>15148939}

Here's where hichris flags.

{"event_type"=>9, "time_stamp"=>1398387950, "content"=>"@Doorknob This is <i>so</i> offensive.", "id
"=>28079242, "user_id"=>103081, "user_name"=>"hichris123", "room_id"=>11540, "room_name"=>"Charcoal
HQ", "message_id"=>15148916, "parent_id"=>15148878, "message_edits"=>1, "message_flags"=>1, "show_pa
rent"=>true}

Now he reports the fact that he flagged...

{"event_type"=>1, "time_stamp"=>1398388067, "content"=>"There.", "id"=>28079244, "user_id"=>103081,
"user_name"=>"hichris123", "room_id"=>11540, "room_name"=>"Charcoal HQ", "message_id"=>15148941}

Now I handle that flag as invalid:

{"event_type"=>9, "time_stamp"=>1398387950, "content"=>"@Doorknob This is <i>so</i> offensive.", "id
"=>28079245, "user_id"=>59776, "user_name"=>"Doorknob", "room_id"=>11540, "room_name"=>"Charcoal HQ"
, "message_id"=>15148916, "parent_id"=>15148878, "message_edits"=>1, "message_flags"=>1, "show_paren
t"=>true}

And I thank hichris

{"event_type"=>1, "time_stamp"=>1398388074, "content"=>"Thanks!", "id"=>28079247, "user_id"=>59776,
"user_name"=>"Doorknob", "room_id"=>11540, "room_name"=>"Charcoal HQ", "message_id"=>15148943}
{"event_type"=>1, "time_stamp"=>1398388077, "content"=>"(marked as invalid :P)", "id"=>28079248, "us
er_id"=>59776, "user_name"=>"Doorknob", "room_id"=>11540, "room_name"=>"Charcoal HQ", "message_id"=>
15148944}

Now I am examining my logs, which is the stuff you're looking at now

{"event_type"=>1, "time_stamp"=>1398388080, "content"=>"Examining logs", "id"=>28079250, "user_id"=>
59776, "user_name"=>"Doorknob", "room_id"=>11540, "room_name"=>"Charcoal HQ", "message_id"=>15148946
}

And then:

PearsonArtPhoto arrives and flags as invalid (setting message_flags to 0, since he's a mod).
It's *highly* troubling that I can figure this out.

{"event_type"=>9, "time_stamp"=>1398387950, "content"=>"@Doorknob This is <i>so</i> offensive.", "id
"=>28079251, "user_id"=>3087, "user_name"=>"PearsonArtPhoto", "room_id"=>11540, "room_name"=>"Charco
al HQ", "message_id"=>15148916, "parent_id"=>15148878, "message_edits"=>1, "show_parent"=>true}

The implications of this is that anyone with 10k rep can see supposedly "private" flagging information. Anyone can see who flagged a message, who flagged as valid, and who flagged as invalid. This is a major problem.

I'm fairly sure that the WebSockets work the same way that /events does. I still haven't figured out the right timestamp to send, but if I'm right, this means that anyone can see all flags ever made.

(This is a separate post from the "seeing stars" post because 1. it's about a different mechanic, 2. it's much more urgently in need of fixing, as it exposes potentially privacy-violating data, and 3. it may be fixed in a different way (hopefully sooner).)

Here is the conversation about this in chat.

Can this be fixed, preferrably as quickly as possible?

  • 21
    This is even worse than heartbleed!!! :P (+1, nice find) – mhlester Apr 25 '14 at 2:09
  • 1
    There's no flag 'requires developer attention' :) – Benjol Apr 25 '14 at 4:58
  • 1
    So ... you mean I can't deny my chat flags ... dangit, this NEEDS to be fixed now!!! – Bart Apr 25 '14 at 8:20
11
+250

Apologies for the delay in answering: sometimes things slip through cracks; triage is not perfect.

The behaviour is unfortunate, and I will endeavour to investigate and remedy this.

Note: an initial glance suggests that "flag for moderator attention" flags are not impacted by this. Only spam/offensive. Likewise, it is not correct that all flags "ever" are recoverable: the window of data available via the scrolling event loop is pretty small (beyond that the client application simply requests a full page reload).

I will, however, investigate how this can be addressed.

Update: this change is deploying now; for these events, the user-id (used to change the UI experience) is now only included for your own events. For other events this is omitted.

|improve this answer|||||
  • 2
    False. Confirmed that I can still see flagger identity on my own posts, and on other people's posts. We did that experiment yesterday (as well as with stars). – Madara's Ghost Jul 2 '14 at 8:16
  • @SecondRikudo that's odd; will double check – Marc Gravell Jul 2 '14 at 8:24
  • 3
    This still appears to be able to be exploited. – hichris123 Jul 28 '14 at 15:14
  • Marc, any update on this? It's been exploited a couple times before, and because of this behavior a "script" can be run to see who flags stuff. – hichris123 Aug 10 '14 at 20:32
  • 1
    @hichris I will investigate in the morning (late evening here) – Marc Gravell Aug 10 '14 at 20:50
  • 1
    Did you find anything that may have caused this still to be exploited? – hichris123 Sep 6 '14 at 17:22
  • @hichris123 deploying something now; it is hopefully resolved – Marc Gravell Sep 8 '14 at 11:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .