Xss vulnerability

[Windows9]

Browser, version and OS: 

Chrome Win 10 1908

Steps to reproduce/what were you doing before it happened?

When you edit a topic, you can bypass XSS protection. Although the code is not executed, someone who has more time might be able to figure out how to exploit it

 

What did you expect to happen?

Cloud flare XSS protection

 

Screenshots of the issue, if applicable:             

 

   

[colonel_mortis]

By XSS protection, you mean Cloudflare? If anything you're posting is triggering Cloudflare, let me know the ray ID of the error and I will turn off that rule - Cloudflare is not and will never be part of our XSS protection.

 

The plain text of your post is already HTML encoded, so putting <script> tags in it doesn't pose any risk.

 

To insert a script that would have a chance of being used, you would need to use inspect element/etc to insert a script into the actual HTML inside the editor, but that content is sanitised using a whitelist - while vulnerabilities are not impossible, and I have found and reported some in the past, they were not simply "insert a script tag" attacks and all exploited a couple of ways to avoid the sanitiser (rather than vulnerabilities in the sanitiser itself) that have now been fixed.

[Windows9]

13 hours ago, colonel_mortis said:

By XSS protection, you mean Cloudflare? If anything you're posting is triggering Cloudflare, let me know the ray ID of the error and I will turn off that rule - Cloudflare is not and will never be part of our XSS protection.

When you try posting a topi with <script> cloudflare blocks it, Ill attach a screenshot

[Windows9]

It dosen't seem to be repeatable anymore, last time I did it 2 times in a row. Also did a mod lock this or did I do it

[Boomwebsearch]

6 hours ago, Windows9 said:

It dosen't seem to be repeatable anymore, last time I did it 2 times in a row. Also did a mod lock this or did I do it

 

@Windows9; It appears as if you have locked the topic, although if I remember correctly, only moderators and admins can lock/unlock topics, is it a new feature or something allowing the original poster to lock topics and how to use it?

[Windows9]

1 hour ago, Boomwebsearch said:

It appears as if you have locked the topic, although if I remember correctly, only moderators and admins can lock/unlock topics, is it a new feature or something allowing the original poster to lock topics and how to use it?

Its not working anymore

[LogicalDrm]

8 hours ago, Windows9 said:

It dosen't seem to be repeatable anymore, last time I did it 2 times in a row. Also did a mod lock this or did I do it

 

Excuse us for having bit of fun. Only moderators and up can lock threads.

[Windows9]

3 minutes ago, LogicalDrm said:

Excuse us for having bit of fun. Only moderators and up can lock threads.

Oh, thought something was wrong. If a mod pastes it in, will it lock it or do they have to click the lock button

[LogicalDrm]

9 minutes ago, Windows9 said:

Oh, thought something was wrong. If a mod pastes it in, will it lock it or do they have to click the lock button

Any message left in thread is manually typed. Some may use macros or paste-collections.

[Windows9]

@colonel_mortis This is a screenshot of what normally happens

[colonel_mortis]

9 hours ago, Windows9 said:

@colonel_mortis This is a screenshot of what normally happens

 

To be able to whitelist the rules that you're hitting, I need to know the ray ID from the error page.

[Windows9]

1 hour ago, colonel_mortis said:

To be able to whitelist the rules that you're hitting, I need to know the ray ID from the error page

This was from some time ago, so no I have no Ray ID available, only this screenshot