4 ms·

I know this feeling all to well. My friends and I created a facebook group in 2005 that doesn't have a name- we managed to sneak some null characters through th

by tedivm 9y ago

I know this feeling all to well. My friends and I created a facebook group in 2005 that doesn't have a name- we managed to sneak some null characters through their filters. Our nameless group occasionally causes problems, including crashing the IOS Facebook app for about a year, but we didn't want to make a bug report because we thought they'd just give the group a name (ultimately one of our friends at Facebook filed a bug report and got it fixed without outing us).

reificator 9y ago
One of the first things I'll do if I notice any unsanitized input causing problems is to find as many examples as I can of the broken/malicious data and use them as test cases while fixing the bug. Obviously I don't stop at what's already in the system, but it's a good starting point. In other words, I wouldn't be surprised if Facebook knows now.
- amboar 9y ago
  The big list of naughty strings is a good place to start when digging up input issues: https://github.com/minimaxir/big-list-of-naughty-strings https://github.com/minimaxir/big-list-of-naughty-strings
  - reificator 9y ago
    Thanks, I think I've used that before but I hadn't bookmarked it yet.
TazeTSchnitzel 9y ago
I recall there being a Twitter account with a username zero characters long. I've only seen retweets of it, because of course, https://twitter.com// https://twitter.com// is treated the same as https://twitter.com/ https://twitter.com/.
- liquidgecka 9y ago
  Not 0 characters long, just full of unicode whitespace that got stripped out of most rendering layers. It was right up there with people like this: https://twitter.com/_ https://twitter.com/_
  - schoen 9y ago
    "Married to @__, Dad of @___" (!)
    - brabel 9y ago
      Wow, and that's not even a joke!
  - lloeki 9y ago
    Hm. That handle checks out as valid perl. Now I probably should not attempt things that'll waste my entire Sunday afternoon.
  - batbomb 9y ago
    My twitter name is just two underscores followed by a single character.

by tedivm 9y ago

reificator 9y ago

One of the first things I'll do if I notice any unsanitized input causing problems is to find as many examples as I can of the broken/malicious data and use them as test cases while fixing the bug. Obviously I don't stop at what's already in the system, but it's a good starting point. In other words, I wouldn't be surprised if Facebook knows now.

amboar 9y ago
The big list of naughty strings is a good place to start when digging up input issues: https://github.com/minimaxir/big-list-of-naughty-strings https://github.com/minimaxir/big-list-of-naughty-strings
- reificator 9y ago
  Thanks, I think I've used that before but I hadn't bookmarked it yet.

TazeTSchnitzel 9y ago

I recall there being a Twitter account with a username zero characters long. I've only seen retweets of it, because of course, https://twitter.com// https://twitter.com// is treated the same as https://twitter.com/ https://twitter.com/.

liquidgecka 9y ago
Not 0 characters long, just full of unicode whitespace that got stripped out of most rendering layers. It was right up there with people like this: https://twitter.com/_ https://twitter.com/_
- schoen 9y ago
  "Married to @__, Dad of @___" (!)
  - brabel 9y ago
    Wow, and that's not even a joke!
- lloeki 9y ago
  Hm. That handle checks out as valid perl. Now I probably should not attempt things that'll waste my entire Sunday afternoon.
- batbomb 9y ago
  My twitter name is just two underscores followed by a single character.