[IgorPartola]

Anyone else already find the XSS in genius.it?

Edit: wow, the whole thing is seriously broken. Emailing them now.

Edit 2: It's not as broken as I thought, and these guys are quick to reply and try to figure things out. To be clear, I haven't gotten it to run arbitrary JS, just include arbitrary HTML, which isn't as dangerous.

[tomlemon]

Let us know this'd be very helpful! [e-mail]

[paulirish]

BTW would really love to link to a particular annotation.

[IgorPartola]

I noticed it when http://genius.com/5104616 was broken where John included the <div> tag.

[IgorPartola]

Emailed.

[homakov]

>Anyone else already find the XSS in genius.it?

This is a sandboxed domain, like googleusercontent, so not a bug. XSS on genius.com would be a vulnerability.

[glandium]

How is including arbitrary html not as dangerous, when arbitrary html also means <script> tags?

[nightpool]

I'm not sure what exactly he's referring to, but annotations allow you to use markdown and some (limited, heavily sanatized and whitelisted) html, so that could be what he was talking about.

[glandium]

heavily sanitized and whitelisted html isn't really arbitrary, is it?

[IgorPartola]

To clarify, it appears that both genius.it and genius.com use Markdown which allows HTML. Their code sanitizes it, so that you can't include attributes of tags, and you can't include certain tags such as <script>, <style>, <link>, or <meta>. I spent about 10 minutes on it and could not break it. That isn't to say it cannot be broken, just that it's not wide open and obvious attacks are mitigated.

I was able to XSS myself: when I added certain types of malicious code it did execute, but if I reload the page the malicious part is not rendered. In other words, it's filtered on the output, not input, and the rendering is different for content fetched from the server vs content you just created. You can execute code in your own browser, but not for anyone else (as far as I was able to).

Their team is very responsive and took my concerns over this seriously.