Skip to content

Instantly share code, notes, and snippets.

@ianrandmckenzie
Last active November 14, 2021 08:15
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ianrandmckenzie/57cf8f101c04702f3bd8d52f4c9f6b5c to your computer and use it in GitHub Desktop.
Save ianrandmckenzie/57cf8f101c04702f3bd8d52f4c9f6b5c to your computer and use it in GitHub Desktop.
Bad UX or Stack Overflow Vulnerability?

The Problem

I can edit questions and answers completely anonymously in the front-end.

How I discovered it

I found an answer where a code example was missing a closing curely bracket. I decided to edit the answer and add the missing curly brace to help save a newbie some potential frustrations. However, I quickly found out that Stack Overflow requires a six-character minimum to allow edits. I felt like that was BS, so I reacted a bit emotionally and decided to bypass the requirement by adding an invisible diacritic unicode character to meet the quota. At first I thought my bypass failed because I didn't show up in the edit history. But, the closing curly bracket was there.

How I confirmed it was repeatable

I went to the first page of questions and tried to edit the first question I saw. The question used the term 'z axis' so I changed it to 'z-axis' since I felt like that was a non-destructive way to test the bug I found. So, I added the hyphen and my 6 diacritics and successfully edited the question anonymously.

Links

The answer where I discovered the bug: https://stackoverflow.com/a/30204697/2351224

The question where I confirmed the bug can be repeatable: https://stackoverflow.com/questions/69961259/np-min-in-in-3d-numpy-array-in-swi-nii-imagemedical-image

...aaaaaand now I see this:

Screen Shot 2021-11-14 at 12 11 39 AM

Did I just waste all this time because I for whatever reason I didn't see the messages until navigating back through my Stack Overflow history 20 minutes later? Argrhgrhrggrhhhhhh

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment