22

XSS?

the title of the question should be "why is <br> a tag..." but the literal html tag is being put in there. This is at least a bug, at worst arbitrary HTML being inserted into everyone's browser.

5
  • I've noticed this occurring in several StackApps as well... While most of SE is good about treating titles as plain text and encoding as-needed, it appears likely to become a stumbling block for new clients.
    – Shog9
    Commented Aug 15, 2010 at 21:18
  • Just noticed this myself and came to note it :) Commented Aug 15, 2010 at 21:27
  • I hope someone doesn't ask : "Why is <script>alert('XSS')</script> so often used to test XSS ?"
    – HoLyVieR
    Commented Aug 15, 2010 at 23:36
  • @HoLyVieR they would have to both ask it and have it become popular
    – cobbal
    Commented Aug 15, 2010 at 23:47
  • @HoLyVieR I actually considered that, but didn't think it would make it to "Hot questions".
    – user1686
    Commented Aug 16, 2010 at 10:15

1 Answer 1

5

A fix will be pushed out this evening - thanks for reporting this!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .