algolia / hn-search

Hacker News Search
http://hn.algolia.com
Other
549 stars 74 forks source link

possible XSS problems #202

Closed yuhong closed 2 years ago

yuhong commented 3 years ago

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=interior%20office&sort=byPopularity&type=comment redirects to stackoverflow, probably due to an XSS problem

Haroenv commented 3 years ago

This seems unexpected indeed, the relevant comment is:

Looks like it's a cut/paste error. If you do wget www.doioig.gov, this is the page you get. Notice the meta refresh that points to stackoverflow.com.<p><pre><code>  &#60;!DOCTYPE HTML&#62;\n  &#60;html lang=\"en-US\"&#62;\n  &#60;head&#62;\n      &#60;meta charset=\"UTF-8\"&#62;\n      &#60;meta http-equiv=\"refresh\" content=\"1;url=http://stackoverflow.com\"&#62;\n      &#60;script language=\"javascript\"&#62;\n          window.location.href = \"http://www.doi.gov/oig/index.cfm\"\n      &#60;/script&#62;\n      &#60;title&#62;Page Redirection&#60;/title&#62;\n  &#60;/head&#62;\n  &#60;body&#62;\n  If you are not redirected automatically, please click the link to continue to the &#60;a href='http://www.doi.gov/oig/index.cfm'&#62;U.S. Department of the Interior Office of Inspector General.&#60;/a&#62;\n  &#60;/body&#62;\n  &#60;/html&#62;</code></pre>

however, highlighted, it seems like the entities have been decoded:

Looks like it's a cut/paste error. If you do wget www.doioig.gov, this is the page you get. Notice the meta refresh that points to stackoverflow.com.<p><pre><code>  <!DOCTYPE HTML>\n  <html lang=\"en-US\">\n  <head>\n      <meta charset=\"UTF-8\">\n      <meta http-equiv=\"refresh\" content=\"1;url=http://stackoverflow.com\">\n      <script language=\"javascript\">\n          window.location.href = \"http://www.doi.gov/oig/index.cfm\"\n      </script>\n      <title>Page Redirection</title>\n  </head>\n  <body>\n  If you are not redirected automatically, please click the link to continue to the <a href='http://www.doi.gov/oig/index.cfm'>U.S. Department of the <em>Interior</em> <em>Office</em> of Inspector General.</a>\n  </body>\n  </html></code></pre>

the objectID is 5311430

I haven't yet dug deeper to find out why the entities are decoded

jcubic commented 2 years ago

This seems to be fixed. Why not close the issue?

yuhong commented 2 years ago

https://github.com/algolia/hn-search/commit/a54c165e815c66f558f10bd0eaf826d8d5c4cb08