https://www.vice.com/en/article/buzzy-new-social-media-site-...
It was like AI slop pre AI. Great traction with the nsfw stuff but failed to capitalize on it.
It was like AI slop pre AI. Great traction with the nsfw stuff but failed to capitalize on it.
Oh.
Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0]
Posts could contain a safe subset of html (no scripting) including <img> as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality.
>If you don't want to call that an XSS, what would you like to call that?
I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended.
[0] https://bughunters.google.com/learn/invalid-reports/web-plat...
[1] https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc...