# On dollar signs in the user Location field, and character limits on overlong Locations displayed in the Users page

Here's one of the weirder bugs I've seen in some time:

I have no idea why the user in question chose to enter... whatever that string is, as their location. I don't really care - I think it's weird, but it's their profile page and they can do whatever they want with it. I imagine it's some kind of hash, which would not be unreasonable. (Or it's just a random string. Not that you'd be able to tell the two apart.)

In any case, it's probably a good idea for the profile-page code to:

• Impose a maximal character length for the location when it is displayed in the users table. Regardless of the failed MathJax, user locations shouldn't be breaking the overall formatting anyways.

Alternatively, impose a meaningful CSS height limit on that box.

• Sanitize dollar signs, at least in sites that use MathJax. We can probably assume reasonably safely that people aren't going to be using MathJax in their location fields.

• Scratch that - and punch it in as another entry for "falsehoods programmers believe". A quick query pulls seven users on Physics with dollar signs in their Location field, four of which are intentional MathJax users; ditto with the maths site. This may be unsolvable but maybe there's a better approach?

For this specific user, they either want to have the dollar signs display (in which case, it's just a matter of pointing this out and getting them to \$ escape them), or they intentionally added a $...&...\$ MathJax error to make it bug out? The latter strikes me as unlikely (but potentially abusive behaviour if it is). I don't know what to do on more general cases, though.

Either way, the MathJax compilation error strikes me as not-a-bug anymore: it's just the system behaving as intended (providing MathJax compilation to users if they want to sue it) with a failed compilation much like you get elsewhere. However, perhaps there's some room to raise some flags that could be raised at character-entry time to say "this isn't going to look like you think it's going to look.

• Instead of or in addition to the maximal character length, it might be useful to impose a maximum height in CSS. – David Z Sep 19 '18 at 22:23
• @DavidZ I think there is a CSS limit, but it's set incredibly high. By using \[99999in] in mathjax, the userpage looks like it's 2 km long. If I add another digit, it falls back to normal and doesn't display my location at all. – thermomagnetic condensed boson Sep 22 '18 at 19:56
• This wasn't intentional of course, and I didn't even notice this bug before E.P. pointed it out. But I'll leave it as it is now, so that devs are more "urged" to fix it. I had just chosen a string of random characters. – thermomagnetic condensed boson Sep 22 '18 at 19:57
• @coniferous_smeller The MathJax compilation error isn't a bug - it's a MathJax-enabled field (like, say, a question title) that has faulty MathJax in it (like, say, a question body where OP put in random characters for some legitimate reason but failed to escape them properly). – E.P. Sep 22 '18 at 20:00
• The CSS is indeed a bug, though. – E.P. Sep 22 '18 at 20:00
• So, are we getting any feedback? Because I feel bad letting the broken page like that... but I want things to be fixed. – thermomagnetic condensed boson Sep 22 '18 at 20:04
• @coniferous_smellerULPBG-W8ZgjR It's your location - you should be able to set it to whatever you want. I would recommend toning it down a tad so that the users page is usable but still broken. Hopefully that'll catch the dev team's attention. – E.P. Sep 22 '18 at 20:09
• We're lucky it's just the location field... If you can bypass the character restrictions on display names then you can REALLY mess stuff up. – Shog9 Sep 22 '18 at 22:59
• @Shog9 ah, yes. I saw one such question and wondered what was going on. – E.P. Sep 22 '18 at 23:00