-2

I just saw a post on the site by a user with the username "gmail.com". There is also an active user "yahoo.com". Is this not a potential security threat for some cross-site scripting scenario?

6
  • 5
    Could you explain any example of potential cross-site scripting scenario with these username?
    – Andrew T.
    Commented Jun 6, 2018 at 7:23
  • It's not an XSS issue, but I did wonder about these names as well. I'm not aware of any SE policy regarding impersonation of a brand though.
    – tim
    Commented Jun 6, 2018 at 8:36
  • 3
    BTW, it’s the same user who used to be “yahoo.com” and is now “gmail.com” (and was “anonymous” before, I think).
    – chirlu
    Commented Jun 6, 2018 at 14:53
  • @Andrew T. if someone replies to that user by putting "@" before their username, I don't know how the partial parse of that message would go. But even just because I don't know how this can be exploited, it doesn't mean that this shouldn't raise a red flag about someone potentially trying to probe the site's vulnerabilities.
    – grovkin
    Commented Jun 6, 2018 at 23:39
  • @grovkin I would contend that does mean it shouldn't raise a red flag. meta.stackexchange.com/questions/43019/… might be of interest.
    – user9389
    Commented Jun 7, 2018 at 16:10
  • @ is not a special character in the context of web applications (only email, which is quite different). It's characters such as <, >, as well as some others that need to be dealt with for web security (and SE does that correctly). So this is not really an issue.
    – user11249
    Commented Jun 14, 2018 at 18:02

1 Answer 1

Reset to default
2

https://firebounty.com/bug-bounty-program/302/stack-exchange says to take any suspected problem to https://meta.stackexchange.com/contact and to NOT answer @AndrewT.

If there is a real issue report it, if you want to know what issues having weird usernames can cause and how to mitigate them in general take it to security.se.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .