Wikihow: Possible XSS Vulnerability about zeroclickinfo-fathead HOT 8 CLOSED

We're investigating a frontend fix for this.

As @tagawa and @pjhampton mentioned, there isn't a real vulnerability here as it's just an input on the page. With DuckDuckHack in maintenance, the Fatheads are not being updated so for now this is more of an issue of the SERP breaking.

The IA is being taken offline (and some others that are breaking the SERP) and once we manage to fix we'll bring them back.

from zeroclickinfo-fathead.

I agree with @pjhampton, and I feel like this is more of a HTML injection. https://www.owasp.org/index.php/Testing_for_HTML_Injection_(OTG-CLIENT-003)

Thanks for taking care of DuckDuckGo 🥇 🙂

from zeroclickinfo-fathead.

Thanks for filing this @javathunderman. We've disabled this IA for now until a fix is released.
By the way, the content shown from wikiHow is actually data we've parsed and cached so not live data, which reduces the threat a little but is still obviously something we need to fix.
/cc @bbraithwaite

from zeroclickinfo-fathead.

Sorry I'm late to the party.

Weird, I thought we had dealt with this early on in the post-processing of the data. However, this was a consistent issue with the FatHead IAs for programming

However, are we really sure this is XSS vulnerable? 🤔 https://www.owasp.org/index.php/Testing_for_Cross_site_scripting

I have ran some tests of my own and got someone else to look at this as well.

What testing has the OP of that post done? How has he submitted a value via a vanilla textarea? Needs more details... disable if you guys feel fit though.

edit: I moved on slightly after this IA was developed, so I'm not sure how it was maintained to be honest. But it does look like it could be updated and run again for fresher info.

from zeroclickinfo-fathead.

This has been fixed.

from zeroclickinfo-fathead.

The link above (https://duckduckgo.com/?q=how+to+create+big+block+text+box) still loads the wikihow answer for me. Tried in Firefox 60.0.1 for Ubuntu (in a private window) & Chromium 66.0.3359.181 (incognito).

from zeroclickinfo-fathead.

from zeroclickinfo-fathead.

@kyzn @javathunderman Thanks for spotting that. Not sure what happened but I've just let the developers know.

from zeroclickinfo-fathead.