YouTube Hit By HTML Injection Vulnerability 224
Virak writes "Several hours ago, someone found an HTML injection vulnerability in YouTube's comment system, and since then sites such as 4chan have had a field day with popular videos. The bug is triggered by placing a <script> tag at the beginning of a post. The tag itself is escaped, but everything following it is cheerfully placed in the page as is. Blacked out pages with giant red text scrolling across them, shock site redirects, and all sorts of other fun things have been spotted. YouTube has currently blocked such comments from being posted and set the comments section to be hidden by default, and appears to be in the process of removing some of these comments, but the underlying bug does not seem to have been fixed yet."
Series of tubes... (Score:5, Funny)
All of your tubes are belonging to US now.
I experienced this! (Score:5, Funny)
I went to youtube, but all I saw was crap material. Someone had injected a bunch of crap!
Re:Series of tubes... (Score:5, Funny)
Somebody set up us the script bomb
Re:Ha ha (Score:5, Funny)
Based on the typical YouTube comment (or video, for that matter), I already hard sort of expected that to be the case.
The very definition of Youtube (Score:5, Funny)
This exploit is just an alternative to the original "Upload Video" button.
Why natural language needs grouping symbols (Score:5, Funny)
a "How to learn PHP in 24 hours!" book
Does that mean:
1. It teaches you, over the course of an unspecified period of time, how to learn PHP in 24 hours?
2. It teaches you, over the course of 24 hours, how to learn PHP? or
3. After 24 hours have elapsed, it teaches you how to learn PHP?
Note that it doesn't actually teach you PHP. It just teaches you how to learn it.
Someone needs to lose their job over this (Score:1, Funny)
What idiot doesn't check user input with at least a regex replace to look for offending tags in fields *YOU KNOW* will be rendered by an HTML interpreter (browser)?
Languages like PHP even have built-in routines that will strip out all HTML tags except for safe one you specify, it's been a few years, but I believe it's called htmlSafeTags(string, array of safe tags).
This isn't a simple mistake, it's a sign of pure incompetence since the developer put no forethought into the uses of the tool he was developing and blindly trusted user input from a textarea. User input is dirty, dirty dirty and any developer who does not clean and sanitize it before consuming it is not doing his/her job.
Re:Why natural language needs grouping symbols (Score:3, Funny)
No, it tells you how you learn the lesser-known language named "PHP in 24 hours" which differs from normal PHP in that the scripts always take 24 hours to run.
Massive rickroll? (Score:5, Funny)
If they didn't redirect ALL videos to a Rick Astley video, they have missed the opportunity of a lifetime.
Re:Why natural language needs grouping symbols (Score:3, Funny)
I can't wait 24 hours! Got to get 12 hour book...
Re:Series of tubes... (Score:5, Funny)
Really? They're really only removing some of them? When they can just do a simple delete query and wipe everythin with a properly escaped script tag at the top of the comment? Wow. Just wow.
Shhh.... one word... overtime pay.
Re:Ha ha (Score:5, Funny)
YouTube is supposed to be a kid-friendly place. Parents could do their best to try to responsibly monitor and guide their kids' surfing habits, but still fail because of this exploit. This is not funny, nor awesome. This is not someone finding a potential exploit and graciously letting Google know so they can patch it up. Just a bunch of 4channers screwing around, and to hell with the consequences. And people like you encouraging that type of behaviour.
Just because this is The Internet(TM), it doesn't mean that common courtesy need not apply.
Re:Series of tubes... (Score:5, Funny)
Re:... if you want to keep it (Score:5, Funny)
*Reads list of filtering options*
So does it just hide the whole comment section, or show it as being empty?
Re:Why natural language needs grouping symbols (Score:3, Funny)
I've seen the book, option 3 is the correct answer.
It's 1,440 pages of "Wait one minute, then turn the page" which sadly forces one into an inescapable loop for 24 hours. After one has starved, missed sleep and soiled oneself through this excruciating 24 hour period the last page says only this:
Buy the book titled 'This book teaches you PHP'.
I was thoroughly disappointed.
Re:Why natural language needs grouping symbols (Score:5, Funny)
No, it tells you how you learn the lesser-known language named "PHP in 24 hours" which differs from normal PHP in that the scripts always take 24 hours to run.
An optimized version, then? ;)
Re:Why natural language needs grouping symbols (Score:5, Funny)
The first time I hear anyone ever fucking utter the word "Kibisecond" I'm just going to shoot them in the face. There's no other choice.
Re:Why natural language needs grouping symbols (Score:2, Funny)
How many Lojbanists does it take to change a broken light bulb? ...
Two: one to figure out what to change it into, and one to figure out what kind of bulb emits broken light.
Re:Ha ha (Score:5, Funny)
Physical age doesn't necessarily correspond to mental age. Personally, I've been getting more immature as years pass.
"I have abandoned the quest for eternal youth and instead setttled for lifelong immaturity"
Re:... if you want to keep it (Score:1, Funny)
Did anyone else read that list as:
* All capital letters
* ????
* Profanity
Re:Why natural language needs grouping symbols (Score:3, Funny)
Dont worry, he'll be back in a kibisecond.
What I learned from this story (Score:4, Funny)
What I learned from this story:
That goatse.cx is very old news and that there are whole new horrors I never even heard of.
Someone must be looking out for me.
You know you are living a blessed life when you got no idea what 1man1jar or lemon party is. Reminds me of being a little kid and having no idea what the adults were talking about. Only this time I know the value of ignorance.
Let me see. 1 man 1 jar, must be about a man collecting pennies to buy a gift for his mother.
Lemon party? Sweet lemonade for a hot summer day? Sounds fun.
2girls1cup? Two girls riding the magic cup at disney?
Please, don't correct me. Ignorance is bliss.