Iframe in expanded quote

bug
1

iframes can be injected into an expanded quote.

<iframe src=“https://meta.discourse.org”>

Originally noticed here.

5 Likes
2

Expand this quote to see an iframe.

1 Like
3

This topic is now unlisted. It will no longer be displayed in any topic lists. The only way to access this topic is via direct link.

4

Looks like a security issue, I unlisted it @zogstrip will look at this ASAP

5

That’s a really good finding @boomzilla. Fixing it!

6

XSS?  ­­­

7

That’s an awesome find.

8

Interesting enough, I couldn’t double escape the cooked version of the post otherwise jQuery wasn’t able to parse it properly… So I had to only slightly double escape it.

https://github.com/discourse/discourse/commit/9b29a23ecee5957974bc5504d0759984fae03043

9

Yeah I think there is potential to exploit, but not a clear XSS cause the iframe is in a sandbox.

It’s nitpicking though, I say award the XSS badge.

1 Like
10

Installed and confirmed patched on ours.

1 Like