I just saw a post on the site by a user with the username "gmail.com". There is also an active user "yahoo.com". Is this not a potential security threat for some cross-site scripting scenario?

| |
  • 5
    Could you explain any example of potential cross-site scripting scenario with these username? – Andrew T. Jun 6 '18 at 7:23
  • It's not an XSS issue, but I did wonder about these names as well. I'm not aware of any SE policy regarding impersonation of a brand though. – tim Jun 6 '18 at 8:36
  • 3
    BTW, it’s the same user who used to be “yahoo.com” and is now “gmail.com” (and was “anonymous” before, I think). – chirlu Jun 6 '18 at 14:53
  • @Andrew T. if someone replies to that user by putting "@" before their username, I don't know how the partial parse of that message would go. But even just because I don't know how this can be exploited, it doesn't mean that this shouldn't raise a red flag about someone potentially trying to probe the site's vulnerabilities. – grovkin Jun 6 '18 at 23:39
  • @grovkin I would contend that does mean it shouldn't raise a red flag. meta.stackexchange.com/questions/43019/… might be of interest. – user9389 Jun 7 '18 at 16:10
  • @ is not a special character in the context of web applications (only email, which is quite different). It's characters such as <, >, as well as some others that need to be dealt with for web security (and SE does that correctly). So this is not really an issue. – user11249 Jun 14 '18 at 18:02

https://firebounty.com/bug-bounty-program/302/stack-exchange says to take any suspected problem to https://meta.stackexchange.com/contact and to NOT answer @AndrewT.

If there is a real issue report it, if you want to know what issues having weird usernames can cause and how to mitigate them in general take it to security.se.

| |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .