18

Ten days ago, I reported a cross-site scripting bug on a stackexchange.com subdomain, and two days ago, I inquired if my report was received and whether I could help with further information. But so far I didn't receive a response to either message. Am I too impatient or did the report get lost?

Since XSS flaws aren't terribly severe, I understand that fixing this one might not be a top priority among other security bugs. But since I also didn't get the usual "we received your report and we'll have a look" within the first few days, I figured something might have technically gone wrong.

(I submitted the bug via the contact form and included the words "security vulnerability", as instructed here. I would have gone through HackerOne, but didn't get access to the private beta program.)

  • 1
    For the messages I send via the Contact Form I never got a confirmation, only a response when it was handled. That can take 6 to 8 weeks .... if you want to know your message didn't went missing you can ping @JNat in the Tavern, at least that is what I did when I became impatient ... – rene Nov 30 '17 at 16:41
  • @rene Thanks, that helps. I guess I'll just wait (and hope it's still reproducible then). – Arminius Nov 30 '17 at 16:54
  • XSS should be considered high priority, considering posting a few choice scripts to HNQ could do massive harm, anything from denial of service attacks to crypto mining to spam to simply causing everyone who runs the script to delete their own account (which IIRC can be scripted in the browser). – forest Apr 24 '18 at 23:34
1

The report was assigned to someone and has been looked at. The amount of time it takes for them to actually be analyzed and/or fixed varies wildly based on the type of report it is (I wouldn't be able to give you an estimate). But also keep in mind that last week was a holiday week where all of the US employees had Thursday and Friday off, which also cuts the amount of time people have to work on things.

  • Great, thanks for letting me know. I absolutely understand it takes time to analyze and fix a bug. What worried me was the lack of any (automated) response at all. It wouldn't have been the first time that an over-enthusiastic mail filter swallows a "suspicious" message. – Arminius Nov 30 '17 at 20:59
  • 5
    When you submit tickets through the contact form, the email actually gets sent to team@ from team@ and we have a filter set up in Gmail to never send messages from team@ to spam, so it's actually not possible for a message from that form to get "lost" unless our code just completely failed for some reason (in which case you'd more than likely have received an on-site error). Not that people would know that, but just a fun fact. ^_^ – animuson Nov 30 '17 at 21:01
  • 8
    Why not send something once a ticket/report is being assigned, so that the sender will know it's being handled? It's matter of minutes, even less if using automated response or template. – Shadow Wizard Nov 30 '17 at 21:45
  • @ShadowWizard We sometimes do. We don't always think about it. – animuson Nov 30 '17 at 21:53
  • 5
    @animuson Sorry I'm getting back to this, but it's now almost three months without any feedback. I'd really love to see this security bug be resolved. Could you give me a quick status update? – Arminius Feb 16 '18 at 14:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .