XSS in Ask Question page

Question

Copy paste following in browser bar,

https://stackoverflow.com/questions/ask?title=test"><script>alert(1)</script>"&tags="></a></div><script>alert(/1/)</script><foo+bar="

or

Found out tag description field is not html escaped.

No repro in Chrome 11 dev, but reproduced in Firefox 4's latest nightly. (Windows 7) — alexia, Mar 12, 2011 at 18:40
I did get an alert in Chrome 9, Gentoo. Did Chrome add fanciness to detect stuff like this? — Michael Mrozek, Mar 12, 2011 at 18:49
@Michael, I don't know but In html source, there is plain <script tag, but somehow, my chrome 11 also can't get executed somehow. — YOU, Mar 12, 2011 at 18:54
@Michael I've turned on XSS protection in about:flags, though it disappeared in Chrome 11. — alexia, Mar 12, 2011 at 18:59
@Arjan Nope, I just wanted to give some credit to balpha for that Hacker badge, even if it's not real! :) — alexia, Apr 27, 2011 at 5:21
@YOU Confirmed in Firefox 4 on Mac. With NoScript turned on, it's detected at as an XSS attempt as well. — Dan Blows, Apr 27, 2011 at 16:30
@Blowski, Actually, this supposed to be fixed already. Edit: Checked and confirmed on my firefox with NoScript too. Probably NoScript alerting everything with <script> tag in url — YOU, Apr 27, 2011 at 16:31
@YOU Yes, just checked with NoScript disabled and it's fine. Good to know that's what NoScript does... — Dan Blows, Apr 27, 2011 at 16:38

balpha · Accepted Answer · 2011-03-12 18:57:42Z

9

+100

Just imagine it's a real one – it's for you:

Hacker badge

answered Mar 12, 2011 at 18:57

balphaStaffMod

155k44 gold badges489 silver badges659 bronze badges

2

cool!, very quick response, thanks, I now like to have that badge :D
– YOU
Mar 12, 2011 at 18:59
4

Hm, so alert(false) doesn't count for the Hacker badge?
– badp
Mar 13, 2011 at 13:45

Add a comment |

1 Answer 1