Possible security issue with discourse retort emojis

[Arisa]

Hii

so basically server doesn’t check if the emoji sent by the client is valid so the client is able to change “title” and “alt” attributes for the emoji <img with inspect element and send a custom message in an emoji, for someone not experienced with computers it may seem like the person wrote the text even though it just emoji by another user, could lead to some impersonation basically

[sam (Sam Saffron)]

Not following, can you reply with an example? This looks like retort which is not an official plugin. Discourse reactions renders differently.

[Arisa]

Ah, so it’s an external plugin, I had no idea.
Yes, it seems to be retort from the body of the request when reacting with emoji.

[Arisa]

Feature request: Prevent manipulation

it’s even reported on the repo so yeah

[sam (Sam Saffron)]

For future travelers here, our official plugin is:

Discourse Reactions - Beyond Likes

Bored of likes in discourse? Here’s something you will definitely love. Overview Discourse-reactions is a plugin that allows user to add their reactions to the post. This plugin can engage more audiences to the post. Users who may not have previously wanted to Like your content are now able to send more specific signals about how your content makes them feel. Users who may not have wanted to use their phones to post can now use them to “react” much easier. Reactions can be different on each w…

This issue does not impact the official plugin.