Edent, 2 months ago (edited 2 months ago)

Another test! Does your Mastodon client / website render HTML in poll options?

If you see italic text in the first option, please select option 1.

If you don't see italic text in the first option, please select option 2.

If I caused a pop-up, please selection option 3 and report a bug to your software provider 🙂

jaygooby, 2 months ago

@Edent Proper LOL at the 3rd option

Edent, 2 months ago

@jaygooby Only there because my code fell for it 😆

TheDarkBomber, 2 months ago

@Edent wow, i literally just discovered a separate XSS vulnerability in this software today. what a fun coïncidence.

Edent, 2 months ago

@TheDarkBomber haha! Do share 🙂

TheDarkBomber, 2 months ago

@Edent alt text injection vulnerability. the software does not escape quotation marks, so i can just add an onload= attribute, which i tested on a private post, which works.

daniel, 2 months ago

@Edent I notice that from the item view I can see Chinese characters, but from the timeline I see the xn--... address.

Edent, 2 months ago

@daniel thanks - could you please share a screenshot of the timeline view and let me know what client you're using?
Cheers!

daniel, 2 months ago

@Edent This is a screenshot of the Mastodon v4.2.7 web interface. I made a mistake when explaining me. You can see that the URL is displayed twice, one in Unicode and another with the xn code.

Edent, 2 months ago

@daniel gotcha - thanks!

nogweii, 2 months ago

@Edent Tusky on Android. (14, GrapheneOS on Pixel 6 Pro) shows Chinese characters.

jamesdoc, 2 months ago

@Edent Sadness

Edit: did not properly read the message. Caffeine has not hit this morning.

Edent, 2 months ago

@jamesdoc
Did you not read the post? Or are you trying to show me something else?