A discussion on patching a loophole in Discourse that allows users to bypass character limits by using fake HTML was initiated by urias. The issue was first pointed out by not-ethan, who mentioned that inserting excessive HTML characters creates a blank space, potentially enabling spam. Moin shared a link to a Meta Discourse topic discussing the same issue. not-ethan acknowledged that this has been brought up before and requires significant work to fix. They also cited a post by codinghorror explaining that Discourse supports a “safe” subset of HTML, but doesn’t specify what is allowed. Until a patch is implemented, users are advised to flag any instances of this loophole as spam.
Hey people,
on another web that uses Discourse I mentioned users putting a little amount of text in a topic, @not-ethan mention that if the user puts <charectersssssssssssssssssss> this will create a blank space. This is very annoying and can be used to spam topics with nothing in the description, could this be patched, all credits to @not-ethan!
I feel like this has been brought up before here. And I know it has been brought up the Robox Dev Forum thought I cant find the report.
This would also require a lot of work.
We haven’t seen this yet (except me I think when demonstrating it to others). If you see it please flag it as something else.