Faint possibility of #XSS in Web #Tweetdeck client via #Facebook? #security


UPDATE: Confirmed. See this posting. Hat tip to @glynwintle for inspiring me to get off my arse and at least write it up.

I really can’t be arsed to investigate this one, but I raise it for general interest.

See this screencap:

At the top my original tweet as-rendered by web-tweetdeck client, wherein I type HTML as part of a tweet.

Immediately below is the tweet same reflected back from my twitter-send-to-facebook-feed then sucked back in by tweetdeck and rendered in the web client.

Something, somewhere, has decided that my in-tweet HTML deserves to be rendered.

It could be that there is a whitelist, but if there is it’s not very clever:

Let me repeat what I’ve written in this blog before – ANYTHING that takes my tweet content and tries to interpret it is doing it at its own risk.

Tweets should be taken and treated and rendered opaquely.

Compare the onMouseOver bug from last year.

Comments

One response to “Faint possibility of #XSS in Web #Tweetdeck client via #Facebook? #security”

  1. […] on from the previous, see below; original content is in my feed somewhere but looks like: <iMg […]

Leave a Reply

Your email address will not be published. Required fields are marked *