0
$\begingroup$

This question has a comment by user:vasin1987 that appears as a giant block of white text. I'm using Google Chrome v53 on Win7 x64.

Someone else mentioned it appeared blank too. The user said he typed a lot of dollar signs in the comment.

The server may be interpreting it as javascript code, and if so, it would constitute a security vulnerability (javascript injection). Can some admin take a look at it and confirm or deny?

(Edit: I forgot, dollar signs don't delimit javascript code. I think it was question marks.)

$\endgroup$
  • $\begingroup$ Changed the tag to "support", given that it is asking about how to report possible security vulnerabilities. $\endgroup$ – Oded Oct 4 '16 at 14:18
3
$\begingroup$

You can report a general question/bug on meta stack exchange, however I would be very surprised if this was a genuine vulnerability. You're basing your comment off of one which is itself a false report

Dollar signs are a code-element of javascript

Dollar signs are as much "a code element of javascript" as a letter a is - as in they are both valid identifiers (ie, can be used in a variable name) - but neither have any relevance beyond that.


Edit: It appears that this is a simple case of mathjax being allowed in comments.

$\endgroup$
  • $\begingroup$ Paired dollar signs are interpreted by the mathjax library for writing formulas like $\sqrt{A^2}$ in a LaTeX like fashion. There's no javascript injection here. $\endgroup$ – falstro Oct 3 '16 at 10:53
  • $\begingroup$ I suspect this is more something along the lines that SO uses the $ for some specific purpose in comments. They're not expecting people to post many dollar signs - it is a bug of sorts, but not a vulnerability AFAICT (And I know a fair bit about javascript vulnerabilities in web development) $\endgroup$ – Jamiec Oct 3 '16 at 10:54
  • $\begingroup$ It's enabled for some SE sites, Aviation being one of them. $\endgroup$ – falstro Oct 3 '16 at 10:55
  • $\begingroup$ $a^2+b^2=c$ mathjax FTW $\endgroup$ – Jamiec Oct 3 '16 at 10:55
  • $\begingroup$ yep, confirmed comments allow mathjax ^^ Wonder if intentional or not in comments $\endgroup$ – Jamiec Oct 3 '16 at 10:55
  • $\begingroup$ Yeh, see my first comment. :) $\endgroup$ – falstro Oct 3 '16 at 10:56
  • $\begingroup$ Sorry, maybe it was question marks that used to delimit javascript code? These days we just use <script> thankfully. $\endgroup$ – DrZ214 Oct 4 '16 at 0:43
  • 1
    $\begingroup$ "...neither have any relevance beyond that": In JS6 ${ announces a template literal placeholder, but that need to have the 2 chars in the right order. Still fun is possible. $\endgroup$ – mins Oct 4 '16 at 12:00
  • 1
    $\begingroup$ @mins and it needs to be inside a template string. $\endgroup$ – falstro Oct 4 '16 at 14:16
2
$\begingroup$

To report a possible security vulnerability, click on the "contact us" link in the footer.

Fill in the form with the details of the suspected vulnerabilities (use "other" for reason) and submit - the Stack Exchange team will get it.


As for this specific report - this isn't a security vulnerability. Apart from the fact that we don't run JavaScript on the server side, dollars are not special character in that languages.

What you are seeing is the result of dollar signs being interpreted as mathjax (used to render formulas on the site) - we use dollar signs as mathjax delimiters in comments and posts. Given that only dollar signs were used, this causes empty mathjax rendering.

$\endgroup$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .