4 replies to this topic

[Furl]

http://i.imgur.com/GCTE1gb.png

 

meow :3

 

[TheMattgician]

Your image doesn't seem to work. Could you update it?

[Furl]

Ah, whatever.  I'll just explain it fully:

 

When chats are sent from the server dynamically (ie via websocket, not as part of initial page load), usernames aren't escaped.  So if you set your steam username to e.g. `<script>alert('xss')` and then send a message on a lobby chat or on the global chat, everyone that has that page loaded will have that javascript executed when they receive the message.

[TheMattgician]

Alright, the devs noticed. It should be fixed tomorrow.

Thanks for reporting

[Foxy]

Thanks for pointing this out Furl

 

I've hidden this topic until deploy goes out, since this is quite an exploitable bug

Fixed