# How to report a possible security vulnerability?

This question has a comment by user:vasin1987 that appears as a giant block of white text. I'm using Google Chrome v53 on Win7 x64.

Someone else mentioned it appeared blank too. The user said he typed a lot of dollar signs in the comment.

The server may be interpreting it as javascript code, and if so, it would constitute a security vulnerability (javascript injection). Can some admin take a look at it and confirm or deny?

(Edit: I forgot, dollar signs don't delimit javascript code. I think it was question marks.)

• Changed the tag to "support", given that it is asking about how to report possible security vulnerabilities.
– Oded
Oct 4 '16 at 14:18

You can report a general question/bug on meta stack exchange, however I would be very surprised if this was a genuine vulnerability. You're basing your comment off of one which is itself a false report

Dollar signs are a code-element of javascript

Dollar signs are as much "a code element of javascript" as a letter a is - as in they are both valid identifiers (ie, can be used in a variable name) - but neither have any relevance beyond that.

Edit: It appears that this is a simple case of mathjax being allowed in comments.

• Paired dollar signs are interpreted by the mathjax library for writing formulas like $\sqrt{A^2}$ in a LaTeX like fashion. There's no javascript injection here. Oct 3 '16 at 10:53
• I suspect this is more something along the lines that SO uses the $ for some specific purpose in comments. They're not expecting people to post many dollar signs - it is a bug of sorts, but not a vulnerability AFAICT (And I know a fair bit about javascript vulnerabilities in web development) – Jamiec Mod Oct 3 '16 at 10:54 • It's enabled for some SE sites, Aviation being one of them. Oct 3 '16 at 10:55 •$a^2+b^2=c$mathjax FTW – Jamiec Mod Oct 3 '16 at 10:55 • yep, confirmed comments allow mathjax ^^ Wonder if intentional or not in comments – Jamiec Mod Oct 3 '16 at 10:55 • Yeh, see my first comment. :) Oct 3 '16 at 10:56 • Sorry, maybe it was question marks that used to delimit javascript code? These days we just use <script> thankfully. Oct 4 '16 at 0:43 • "...neither have any relevance beyond that": In JS6 ${ announces a template literal placeholder, but that need to have the 2 chars in the right order. Still fun is possible.
– mins
Oct 4 '16 at 12:00
• @mins and it needs to be inside a template string. Oct 4 '16 at 14:16