4 ms·

There was a bug (maybe still is) in airbnb where setting your name to include a certain character would brick your login to the web app because it broke header

There was a bug (maybe still is) in airbnb where setting your name to include a certain character would brick your login to the web app because it broke header parsing. Reported it but was deemed 'non critical'.. Edit, just looked up the mail - It was an 'equals' sign - the reply was: " It sounds like you cannot cause someone else's account to be in this state, only your own account. Is this correct? How would you get someone else to change their account name so that it includes an equals sign? It appears that there's no way to cause another user's account to get into this state, and in this case, I do not see a security implication here. "

avree 6y ago
That does indeed sound non-critical, how many names do you run into with equal signs in them?
- imgabe 6y ago
  Little Bobby Tables’ cousin, Jenny =true
- mpol 6y ago
  The name is just a string, right? If some character in the string is causing havoc, maybe there is something funky going on. This is just one symptom coming up at the surface. It might require a bit of extra investigation to see what is really the underlying problem and if that might cause more and different symptoms elsewhere.
  - hannob 6y ago
    This is a key issue I see with bugbounty programs. They tend to react with "either you can show us that this is a real danger or we'll ignore it". It seems pretty clear that this bug shows something is terribly wrong and probably dangerous. But the reporter might have limits in analyzing the bug, while the company could easily figure out what's going on and fix it.
    - dane-pgp 6y ago
      > They tend to react with "either you can show us that this is a real danger or we'll ignore it". This is a bit of a Catch-22 situation, as I get the feeling that proving the danger would often involve doing things that bounty programs specifically forbid, such as "Moving beyond “proof of concept” repro steps"[0]. That may be part of the reason why Microsoft got away with such a stingy response to the RCE vulnerability found in Teams by Oskars Vegeris.[1] [0] https://www.microsoft.com/en-us/msrc/bounty-online-services?rtc=1 https://www.microsoft.com/en-us/msrc/bounty-online-services?... [1] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md https://github.com/oskarsve/ms-teams-rce/blob/main/README.md
    - dkdk8283 6y ago
      I fault Agile for this and not big bounty implementations. Getting points to address a big because a random internet source pointed it out to us is difficult. There is likely a long backlog of bugs already.
- dane-pgp 6y ago
  Interestingly, Wikipedia does give at least one example: https://en.wikipedia.org/wiki/Equals_sign#Personal_names https://en.wikipedia.org/wiki/Equals_sign#Personal_names
- hoppla 6y ago
  I started a small company with a colon “:” in it. Should have not done that... I regularly encounter services that does not handle it very well
- polm23 6y ago
  When foreign names are written in Japanese there are a couple of ways of handling puncutation, and sometimes an equals sign is used. I hadn't actually thought about why it was used, but it seems an interpunct (・) is used where a space would be and equals can be used for an internal hyphen, or for words that are separated by a space but part of the same unit (de Niro).
  - polm23 6y ago
    Some more detail on this, with citations, from an ask-a-librarian board (in Japanese). https://crd.ndl.go.jp/reference/modules/d3ndlcrdentry/index.php?page=ref_view&id=1000210282 https://crd.ndl.go.jp/reference/modules/d3ndlcrdentry/index....
- fgonzag 6y ago
  You only need to run into one to make someone's life a PITA. Treat names as free strings, because there are a lot of names that do not conform to any notion of western normality.
- nanis 6y ago
  > how many names do you run into with equal signs in them? That's not the issue ... I have not personally tried this or examined it, it looks like you can change the state of the header parser by including interesting characters in your name. I am not sure if this is server-side or client-side. If the problem is server side, there is a chance you could tweak the strings to get interesting results. But trying to prove that this is a serious problem without explicit authorization will likely have adverse consequences for anyone who does, so only people who are already doing shady stuff explore it.
- karmakaze 6y ago
  Whenever someone mistypes their hyphenated name with an =, say on their phone.
- MikusR 6y ago
  https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...
marmshallow 6y ago
Not every little bug that requires technical knowledge is worth a monetary reward.
- Jenk 6y ago
  I haven't seen anyone claim otherwise.
  - quantumsequoia 6y ago
    Well the wording of their response email implies he reported it to a bug bounty program
ehsankia 6y ago
Did you submit it as a bug or a security issue? There are indeed no security risk here, but usability wise, your account being bricked is a pretty serious issue.
- minikomi 6y ago
  Just to their bug bounty program. Thought it would be kind of annoying for someone whose livelyhood depends on the side to be locked out.
  - ehsankia 6y ago
    My guess is that bug bounty programs refers only to security issues (even if the name suggests otherwise), and unfortunately the team triaging it is probably only focused on handling security teams. Actually sometimes triaging is handled by a different company entirely. In general, very few companies have a solid way to reporting normal everyday non-security bugs, even if they are usage breaking.

avree 6y ago

That does indeed sound non-critical, how many names do you run into with equal signs in them?

imgabe 6y ago
Little Bobby Tables’ cousin, Jenny =true
mpol 6y ago
The name is just a string, right? If some character in the string is causing havoc, maybe there is something funky going on. This is just one symptom coming up at the surface. It might require a bit of extra investigation to see what is really the underlying problem and if that might cause more and different symptoms elsewhere.
- hannob 6y ago
  This is a key issue I see with bugbounty programs. They tend to react with "either you can show us that this is a real danger or we'll ignore it". It seems pretty clear that this bug shows something is terribly wrong and probably dangerous. But the reporter might have limits in analyzing the bug, while the company could easily figure out what's going on and fix it.
  - dane-pgp 6y ago
    > They tend to react with "either you can show us that this is a real danger or we'll ignore it". This is a bit of a Catch-22 situation, as I get the feeling that proving the danger would often involve doing things that bounty programs specifically forbid, such as "Moving beyond “proof of concept” repro steps"[0]. That may be part of the reason why Microsoft got away with such a stingy response to the RCE vulnerability found in Teams by Oskars Vegeris.[1] [0] https://www.microsoft.com/en-us/msrc/bounty-online-services?rtc=1 https://www.microsoft.com/en-us/msrc/bounty-online-services?... [1] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md https://github.com/oskarsve/ms-teams-rce/blob/main/README.md
  - dkdk8283 6y ago
    I fault Agile for this and not big bounty implementations. Getting points to address a big because a random internet source pointed it out to us is difficult. There is likely a long backlog of bugs already.
dane-pgp 6y ago
Interestingly, Wikipedia does give at least one example: https://en.wikipedia.org/wiki/Equals_sign#Personal_names https://en.wikipedia.org/wiki/Equals_sign#Personal_names
hoppla 6y ago
I started a small company with a colon “:” in it. Should have not done that... I regularly encounter services that does not handle it very well
polm23 6y ago
When foreign names are written in Japanese there are a couple of ways of handling puncutation, and sometimes an equals sign is used. I hadn't actually thought about why it was used, but it seems an interpunct (・) is used where a space would be and equals can be used for an internal hyphen, or for words that are separated by a space but part of the same unit (de Niro).
- polm23 6y ago
  Some more detail on this, with citations, from an ask-a-librarian board (in Japanese). https://crd.ndl.go.jp/reference/modules/d3ndlcrdentry/index.php?page=ref_view&id=1000210282 https://crd.ndl.go.jp/reference/modules/d3ndlcrdentry/index....
fgonzag 6y ago
You only need to run into one to make someone's life a PITA. Treat names as free strings, because there are a lot of names that do not conform to any notion of western normality.
nanis 6y ago
> how many names do you run into with equal signs in them? That's not the issue ... I have not personally tried this or examined it, it looks like you can change the state of the header parser by including interesting characters in your name. I am not sure if this is server-side or client-side. If the problem is server side, there is a chance you could tweak the strings to get interesting results. But trying to prove that this is a serious problem without explicit authorization will likely have adverse consequences for anyone who does, so only people who are already doing shady stuff explore it.
karmakaze 6y ago
Whenever someone mistypes their hyphenated name with an =, say on their phone.
MikusR 6y ago
https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...

marmshallow 6y ago

Not every little bug that requires technical knowledge is worth a monetary reward.

Jenk 6y ago
I haven't seen anyone claim otherwise.
- quantumsequoia 6y ago
  Well the wording of their response email implies he reported it to a bug bounty program

ehsankia 6y ago

Did you submit it as a bug or a security issue? There are indeed no security risk here, but usability wise, your account being bricked is a pretty serious issue.

minikomi 6y ago
Just to their bug bounty program. Thought it would be kind of annoying for someone whose livelyhood depends on the side to be locked out.
- ehsankia 6y ago
  My guess is that bug bounty programs refers only to security issues (even if the name suggests otherwise), and unfortunately the team triaging it is probably only focused on handling security teams. Actually sometimes triaging is handled by a different company entirely. In general, very few companies have a solid way to reporting normal everyday non-security bugs, even if they are usage breaking.