Skip to content

Instantly share code, notes, and snippets.

View ianrandmckenzie's full-sized avatar
💪
Kicking SaaS, taking CNAMEs.

Ian McKenzie ianrandmckenzie

💪
Kicking SaaS, taking CNAMEs.
View GitHub Profile
@ianrandmckenzie
ianrandmckenzie / so_v.md
Last active November 14, 2021 08:15
Bad UX or Stack Overflow Vulnerability?

The Problem

I can edit questions and answers completely anonymously in the front-end.

How I discovered it

I found an answer where a code example was missing a closing curely bracket. I decided to edit the answer and add the missing curly brace to help save a newbie some potential frustrations. However, I quickly found out that Stack Overflow requires a six-character minimum to allow edits. I felt like that was BS, so I reacted a bit emotionally and decided to bypass the requirement by adding an invisible diacritic unicode character to meet the quota. At first I thought my bypass failed because I didn't show up in the edit history. But, the closing curly bracket was there.

How I confirmed it was repeatable

I went to the first page of questions and tried to edit the first question I saw. The question used the term 'z axis' so I changed it to 'z-axis' since I felt like that was a non-destructive way to test the bug I found. So, I added the hyphen and my 6 diacritics and successfully edited the question

@ianrandmckenzie
ianrandmckenzie / .zshrc
Created November 14, 2021 05:59
My .zprofile / .zshrc
# IANRANDMCKENZIE.ZSHRC
# Largely derivative of my former Medium Rare Inc colleague Yosuke Hasumi's .bash_profile:
# https://gist.github.com/yosukehasumi/fb5c97f661ee3d4e1b41049707606fb5
# Easily reload these configs
# ------------------------------------------------------------
alias reload!='source ~/.zshrc'
# Setting PATH for various tools