🔒 Locked

Potential HTML/Javascript injection exploit with source tags (3)

Started by fastcall22 Jun 23, 2012 at 7:02 PM 3 replies 1.2k views

Original Post

Jun 23, 2012 at 7:02 PM

[source lang="cpp"]
"/>

[/source]

[source lang="cpp"]
const char* str = "maybe two source boxes?";
[/source]

If nothing happens, then move along; nothing to see here.

<.<
>.>

Trying to reproduce what happened in this thread: http://www.gamedev.net/topic/626861-sdl-collision-issue/

Okay, THIS time, I got it.

Cornstalks

Jun 23, 2012 at 7:17 PM

I'm not sure what's supposed to happen... nothing happens (at least no confirm boxes appear) for me on OS X with Chrome or Safari. If you're talking about the contents of the source tags appearing at the top with junk, I reported the same thing awhile ago for the mobile version... let me check if it's fixed for mobile.

Cornstalks

Jun 23, 2012 at 7:21 PM

Ok, looks like your code messed up the javascript 'case I can't edit that post now. Yeah, that thing I reported still happens for mobile, and I'm assuming it's related to this.

fastcall22

Jun 23, 2012 at 7:22 PM

Looks like any HTML-like tags are parsed out of the source box...

Cornstalks

Jun 23, 2012 at 7:27 PM

Looks like any HTML-like tags are parsed out of the source box...

Yeah, that happened when we were discussing knackered code pastes... I'm not seeing the injection exploit though...

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.