10

Here's one of the weirder bugs I've seen in some time:

I have no idea why the user in question chose to enter... whatever that string is, as their location. I don't really care - I think it's weird, but it's their profile page and they can do whatever they want with it. I imagine it's some kind of hash, which would not be unreasonable. (Or it's just a random string. Not that you'd be able to tell the two apart.)

In any case, it's probably a good idea for the profile-page code to:

  • Impose a maximal character length for the location when it is displayed in the users table. Regardless of the failed MathJax, user locations shouldn't be breaking the overall formatting anyways.

    Alternatively, impose a meaningful CSS height limit on that box.


  • Sanitize dollar signs, at least in sites that use MathJax. We can probably assume reasonably safely that people aren't going to be using MathJax in their location fields.

    • Scratch that - and punch it in as another entry for "falsehoods programmers believe". A quick query pulls seven users on Physics with dollar signs in their Location field, four of which are intentional MathJax users; ditto with the maths site. This may be unsolvable but maybe there's a better approach?

      For this specific user, they either want to have the dollar signs display (in which case, it's just a matter of pointing this out and getting them to \$ escape them), or they intentionally added a $...&...$ MathJax error to make it bug out? The latter strikes me as unlikely (but potentially abusive behaviour if it is). I don't know what to do on more general cases, though.

      Either way, the MathJax compilation error strikes me as not-a-bug anymore: it's just the system behaving as intended (providing MathJax compilation to users if they want to sue it) with a failed compilation much like you get elsewhere. However, perhaps there's some room to raise some flags that could be raised at character-entry time to say "this isn't going to look like you think it's going to look.

  • Instead of or in addition to the maximal character length, it might be useful to impose a maximum height in CSS. – David Z Sep 19 '18 at 22:23
  • @DavidZ I think there is a CSS limit, but it's set incredibly high. By using \[99999in] in mathjax, the userpage looks like it's 2 km long. If I add another digit, it falls back to normal and doesn't display my location at all. – thermomagnetic condensed boson Sep 22 '18 at 19:56
  • This wasn't intentional of course, and I didn't even notice this bug before E.P. pointed it out. But I'll leave it as it is now, so that devs are more "urged" to fix it. I had just chosen a string of random characters. – thermomagnetic condensed boson Sep 22 '18 at 19:57
  • @coniferous_smeller The MathJax compilation error isn't a bug - it's a MathJax-enabled field (like, say, a question title) that has faulty MathJax in it (like, say, a question body where OP put in random characters for some legitimate reason but failed to escape them properly). – E.P. Sep 22 '18 at 20:00
  • The CSS is indeed a bug, though. – E.P. Sep 22 '18 at 20:00
  • So, are we getting any feedback? Because I feel bad letting the broken page like that... but I want things to be fixed. – thermomagnetic condensed boson Sep 22 '18 at 20:04
  • @coniferous_smellerULPBG-W8ZgjR It's your location - you should be able to set it to whatever you want. I would recommend toning it down a tad so that the users page is usable but still broken. Hopefully that'll catch the dev team's attention. – E.P. Sep 22 '18 at 20:09
  • We're lucky it's just the location field... If you can bypass the character restrictions on display names then you can REALLY mess stuff up. – Shog9 Sep 22 '18 at 22:59
  • @Shog9 ah, yes. I saw one such question and wondered what was going on. – E.P. Sep 22 '18 at 23:00
5

For the time being, I've reset that user's location. As with much of the obnoxious stuff you can do with MathJax (margin-breaking, big pink fonts) or profile images (porn, swastikas, insults) or usernames (insults) or post text (ASCII porn, insults), the expedient solution is to not do it - or failing that, to report people who do it anyway.

At some point, we should probably do more to lock down what MathJax can do on these sites; not just in the location field, but in comments as well - you can't put 3000 newlines in a comment on non-MathJax sites, you probably shouldn't be able to do the equivalent anywhere else. Personally, I don't see a good reason why we should even render MathJax outside of post bodies; that would massively reduce the surface area for abuse here.

  • 1
    I'm fairly neutral to having MathJax on location fields - there's a few examples where it's been used tastefully and with suitable restraint, but they're few and far-between and I don't think the loss would be that bad. Disabling it on comments, on the other hand, would fundamentally break the functionality of the site; I see the potential for abuse (and I've been known to push the envelope on a couple of occasions) but the response should be to delete the abuse as and when it appears. – E.P. Sep 22 '18 at 23:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .