5

Somebody posted a question on Stack Apps that took out the feed bot in the Stack Apps chat room with no apparent cause (discovered by Brock Adams). The feed bot is pretty important, and so are many other things that use feeds.

The way this potential "attack" works is that some characters in the question that aren't supposed to be in XML aren't escaped, leading to the feed not being valid.
This then breaks any RSS parser that's using a strict XML parser in its backend.

SE Chat handles this by silently deleting the feed, which is not ideal – so I suppose this is really two bug reports in one. But the former issue is more urgent, lest parts of Stack Exchange be taken down by a malformed post.

  • 4
    Note that Brock Adams (full disclosure, that's my alter ego) reported this bug in a private channel, But as wizzwizz4 found the cause, he gets the honor of posting the problem here for the devs to see. – Awesome Poodles Dec 11 '18 at 19:19
  • 1
    Once the malformed post dropped off the RSS, was able to (temporarily) restore the feed -- at least until the next malformed post is created. – Awesome Poodles Dec 22 '18 at 19:58

You must log in to answer this question.

Browse other questions tagged .