Strange thread-breaking poison payload

[yamikuronue]

We discovered, quite by accident, that the string ('[[notifications:whaaargarbl,') (or any similar) will break the text for the buttons for an entire page of the thread. Subsequently exiting and re-entering the thread will reveal the same breakage if and only if the poison payload is on the DOM; wrapping to another page or entering with infiniscroll low enough that it does not display reverts the buttons to normal. In infiniscroll mode, scrolling back up to see the poison payload again will break that post and any above it (as they stream in), but scrolling back down to the bottom and observing a post streaming in there does not break (probably because the payload is no longer on the DOM). Navigation to other threads reveals them to be fine (unless some jerk posted the payload there too ;) )

Screenshot:

[julianlam]

Pending confirmation this bug is now blocking v1.5.0 release.

[yamikuronue]

You may want to drop by, by the way.... our users have gone off the rails :)

[yamikuronue]

So another one was found: a certain payload makes posts after it not appear. I believe it is [[a:a,. Posting ]] will end the effect.

Interestingly, you can reproduce this effect inside of a single post: anything between those two chunks will vanish. Also, I somehow got an upvote notification while my post (between the first and second posts) was "eaten" and someone upvoted one of the bookend posts.

So it was:

someone's post, containing [[a:a

---

My post

---

someone's post, containing ]]

And someone liked the first of those posts, but I got an upvote notification

[yamikuronue]

Oh god it works in the thread list we're doomed

[pitaj]

Sssh bb is ok

[yamikuronue]

My forum is on fire, we're all dying of laughter over here XD

[pitaj]

The reason this happens is because [[abc.xyz, arg1, arg2]] is the token for a translation. You might try adding nodebb-plugin-beep and adding [[ to the list of censored words.

ONLY AS A VERY TEMPORARY SOLUTION.

After a restart, this should re-render [[ as ** so the translator won't get confused. I'll fix this issue in full tonight.

[yamikuronue]

They turned the whole page red by interrupting a code block with the opener such that the codeblock is never closed. It's weirdly pretty :)

[RaceProUK]

I uh… kinda spectacularly broke the topic list testing this 😊

Glad to see a fix is on its way 😄

[yamikuronue]

Is this fix causing this issue for me? I've had missing translations for the flag page for EN_US for a long time, but now it looks worse

[pauljherring]

en-x-pirate:

en-GB:

[yamikuronue]

For context, here's an old screenshot of what it looked like before the fix was applied, so you can sort out what's new and what's an existing bug:

[pitaj]

I did change it so the whole thing shows up when there are arguments to the token. You get more information that way. I could change it so it doesn't show the brackets though.

[yamikuronue]

But now we just have weird brackets... and also, the fix doesn't seem complete, because I'm still seeing red text on certain sandbox threads after the fix was applied. I'm not quite sure how they're doing it though.

[pitaj]

Ya o noticed that the brackets show up facing the wrong way, I'll probably just remove them.