boolshetvanea's blog

codeforces is vulnerable
By boolshetvanea, history, 9 years ago, In English

codeforces is vulnerable to xss

try to put code like: ~~~~~ ~~~~~ without block code and it wont be displaied. good luck to xss codeforces.

  • Vote: I like it
  • -23
  • Vote: I do not like it

»
9 years ago, hide # |
 
Vote: I like it +1 Vote: I do not like it

looool even with block code it is not displaied it was in js written: script (with tags) alert("da"); script (with closen tags)

→ Reply
  • »
    »
    9 years ago, hide # ^ |
    ← Rev. 19  
    Vote: I like it +10 Vote: I do not like it

    Codeforces sanitizes the inputs in some weird way:

    <a href="#" onclick="alert('hi');">lol</a>

    results in

    <a href="#">lol</a>

    and script tags just disappear.

    After experimenting a bit, I think CF parses HTML elements and only keeps what it can verify as allowed.

    → Reply