12 ms·

``` TypeError: Cannot read properties of null (reading 'C') at Ccf (https://docs.google.com/static/document/client/js/157553674-client_js_prod_kix_app.js:11

``` TypeError: Cannot read properties of null (reading 'C') at Ccf (https://docs.google.com/static/document/client/js/157553674-client_js_prod_kix_app.js:1183:846 https://docs.google.com/static/document/client/js/157553674-...) at Bcf (https://docs.google.com/static/document/client/js/157553674-client_js_prod_kix_app.js:1183:338 https://docs.google.com/static/document/client/js/157553674-...) ``` Has something to do with grammar. The document does not fail when `Show grammar suggestion` is turned off.

deleted 4y ago
[deleted]
- dr-detroit 4y ago
tus666 4y ago
Makes sense. I was thinking something to do with document compression but that sounds more likely.
lqet 4y ago
Yup, it is also partially underlined in blue and a popup suggests to replace "And. And." with "And And" just before it crashes.
a-dub 4y ago
does it talk to a grammar check api endpoint or is it done locally? would be funny if it were a remotely exploitable bug in an api endpoint.
- r0snd0 4y ago
  Remotely exploitable bug causing grammar check api to fail to perform grammar checks? Doesn’t sound too exciting.
- a-dub 4y ago
  > Remotely exploitable bug causing grammar check api to fail to perform grammar checks? Doesn’t sound too exciting. famous last words. finding security relevant bugs is often a game of identifying what the original developers might have found to be not "too exciting" or places they were out of their depth and then focusing intense effort on finding their mistakes.
Alex3917 4y ago
Probably just getting triggering excessive backtracking on some regex.
- KMag 4y ago
  Ironic, from the authors of RE2. They know the correct way to implement regexes. Though, when I worked on Google's indexing system, some researchers were having machine learning generate regexes to run on every page in the visible web... and mis-implemented the feature to re-compile the regex to DFA (which re2 effectively lazily converts to NFA via memoization) for every single page load. The speed of the indexing system dropped in half one day, and <Edit: Name Witheld> dug into it. <Name Withheld> took the gperf graph showing the giant node for regex compilation and wrote a savage meme "Your mother doesn't work here. Optimize your own code.", and sent it out to the researchers in question and also the indexing team. Maybe 6 months earlier, I cut into the same researchers for writing and approving C++ header file changes that defined (and leaked) macros "DO" for "{" and "OD" for "}" so that they could write C++ a bit more like Bash. As I remember, the macro leak for DO caused compilation errors in SpiderMonkey, which I fixed. After fixing the breakage, I just left an extra comment on the code review "Really? Leaking DO and OD macros to avoid typing curly braces?" without emailing any lists. They were really embarrassed removed DO and OD within a couple of days, and <Name Withheld> didn't know that I had laid into them a bit 6 months earlier. (I had implemented some very coarse-grained super-lightweight type-based data flow analysis into SpiderMonkey, which is why some of the Google headers were being included while compiling SpiderMonkey.)
  - haliskerbas 4y ago
    Some people might get off on that kind of culture. But this story makes me glad I don’t work there for some reason.
    - KMag 4y ago
      There's a good deal of responsibility in writing code that is going to run over every single page (and PDF document, MS Word doc, the higher ranked Flash animations, etc.) in the visible web. For my part, I once made a bad assumption about how the Google SAX-style parser handled callbacks for zero-length XHTML start-stop tags. I presumed that <title/> would get a callback with the end-of-open-tag and start-of-close-tag pointers being equal, at the character after the close of the tag. Instead, the parser called the callback with the start-of-close-tag pointer after the start-of-close-tag pointer. (I had misinterpreted the API as passing pointers to the start and end of enclosed content.) I had test cases for un-closed <title> tags and <title></title>... but when my code hit production, the few pages (fewer than 1 in a million) that expressed an empty title as <title/> caused my code to try and construct a string with negative length and crashed that portion of the indexing system. I was right to feel very embarrassed for my oversight. I remember the savage meme so clearly because it was quite out of the norm, and I felt bad for the guys since they were so quick to fix things even when not publicly shamed. (Only the author and reviewer got notified when I left a comment on their code review.)
croddin 4y ago
Also, Therefore, And, Anyway, But, Who, Why, Besides, However. Each in caps 5 times with the same word with a period and space after each word and newline at the end is what I have found so far. Can anyone find others? Edit: added words that work found in other comments, and found more.
- cmg 4y ago
  Interestingly, "Or. Or. Or. Or. Or." doesn't trigger it.
  - hoosieree 4y ago
    By DeMorgan's laws, typing this in a Google Doc causes OneNote to crash.
    - DonHopkins 4y ago
      By DeMorgan's Law and Bill and Ted's Excellent Low Precedence Right Associative Postfix Sarcastic Not, "Or. Or. Or. Or. Or. Not!" crashes.
      - chris_wot 4y ago
        I love this comment and I live Bill and Ted’s Excellent Adventure so I transitively love you.
- JoshuaDavid 4y ago
  Probably the weirdest one I've found is "Dearness." "Although", "Besides", and "Moreover" also trigger the behavior.
  - ineedasername 4y ago
    How did you stumble on Dearness?
    - 4y ago
jonnycomputer 4y ago
Ah. So not something with the text data model.
deltarholamda 4y ago
I see Google has finally implemented the Zombie Strunk & White AI like I requested years ago. I did not expect them to weaponize it, but Skynet does as Skynet does.
sharmavinu0024 4y ago
google doc. is well used for typing.
greggsy 4y ago
Presumably people will start running having all sorts of fun fuzzing Google Docs now that they know that it’s not an infallible, opaque product… Any web app pentesters here willing throw in their 2c? Could this offer insights into the way data is parsed in the backend, or might result in something more interesting than a crash?
the_snooze 4y ago
Parsing arbitrary user-provided input? What could possibly go wrong?

deleted 4y ago

[deleted]

dr-detroit 4y ago

tus666 4y ago

Makes sense. I was thinking something to do with document compression but that sounds more likely.

lqet 4y ago

Yup, it is also partially underlined in blue and a popup suggests to replace "And. And." with "And And" just before it crashes.

a-dub 4y ago

does it talk to a grammar check api endpoint or is it done locally? would be funny if it were a remotely exploitable bug in an api endpoint.

r0snd0 4y ago
Remotely exploitable bug causing grammar check api to fail to perform grammar checks? Doesn’t sound too exciting.
a-dub 4y ago
> Remotely exploitable bug causing grammar check api to fail to perform grammar checks? Doesn’t sound too exciting. famous last words. finding security relevant bugs is often a game of identifying what the original developers might have found to be not "too exciting" or places they were out of their depth and then focusing intense effort on finding their mistakes.

Alex3917 4y ago

Probably just getting triggering excessive backtracking on some regex.

KMag 4y ago
Ironic, from the authors of RE2. They know the correct way to implement regexes. Though, when I worked on Google's indexing system, some researchers were having machine learning generate regexes to run on every page in the visible web... and mis-implemented the feature to re-compile the regex to DFA (which re2 effectively lazily converts to NFA via memoization) for every single page load. The speed of the indexing system dropped in half one day, and <Edit: Name Witheld> dug into it. <Name Withheld> took the gperf graph showing the giant node for regex compilation and wrote a savage meme "Your mother doesn't work here. Optimize your own code.", and sent it out to the researchers in question and also the indexing team. Maybe 6 months earlier, I cut into the same researchers for writing and approving C++ header file changes that defined (and leaked) macros "DO" for "{" and "OD" for "}" so that they could write C++ a bit more like Bash. As I remember, the macro leak for DO caused compilation errors in SpiderMonkey, which I fixed. After fixing the breakage, I just left an extra comment on the code review "Really? Leaking DO and OD macros to avoid typing curly braces?" without emailing any lists. They were really embarrassed removed DO and OD within a couple of days, and <Name Withheld> didn't know that I had laid into them a bit 6 months earlier. (I had implemented some very coarse-grained super-lightweight type-based data flow analysis into SpiderMonkey, which is why some of the Google headers were being included while compiling SpiderMonkey.)
- haliskerbas 4y ago
  Some people might get off on that kind of culture. But this story makes me glad I don’t work there for some reason.
  - KMag 4y ago
    There's a good deal of responsibility in writing code that is going to run over every single page (and PDF document, MS Word doc, the higher ranked Flash animations, etc.) in the visible web. For my part, I once made a bad assumption about how the Google SAX-style parser handled callbacks for zero-length XHTML start-stop tags. I presumed that <title/> would get a callback with the end-of-open-tag and start-of-close-tag pointers being equal, at the character after the close of the tag. Instead, the parser called the callback with the start-of-close-tag pointer after the start-of-close-tag pointer. (I had misinterpreted the API as passing pointers to the start and end of enclosed content.) I had test cases for un-closed <title> tags and <title></title>... but when my code hit production, the few pages (fewer than 1 in a million) that expressed an empty title as <title/> caused my code to try and construct a string with negative length and crashed that portion of the indexing system. I was right to feel very embarrassed for my oversight. I remember the savage meme so clearly because it was quite out of the norm, and I felt bad for the guys since they were so quick to fix things even when not publicly shamed. (Only the author and reviewer got notified when I left a comment on their code review.)

croddin 4y ago

Also, Therefore, And, Anyway, But, Who, Why, Besides, However. Each in caps 5 times with the same word with a period and space after each word and newline at the end is what I have found so far. Can anyone find others? Edit: added words that work found in other comments, and found more.

cmg 4y ago
Interestingly, "Or. Or. Or. Or. Or." doesn't trigger it.
- hoosieree 4y ago
  By DeMorgan's laws, typing this in a Google Doc causes OneNote to crash.
  - DonHopkins 4y ago
    By DeMorgan's Law and Bill and Ted's Excellent Low Precedence Right Associative Postfix Sarcastic Not, "Or. Or. Or. Or. Or. Not!" crashes.
    - chris_wot 4y ago
      I love this comment and I live Bill and Ted’s Excellent Adventure so I transitively love you.
JoshuaDavid 4y ago
Probably the weirdest one I've found is "Dearness." "Although", "Besides", and "Moreover" also trigger the behavior.
- ineedasername 4y ago
  How did you stumble on Dearness?
  - 4y ago

jonnycomputer 4y ago

Ah. So not something with the text data model.

deltarholamda 4y ago

I see Google has finally implemented the Zombie Strunk & White AI like I requested years ago. I did not expect them to weaponize it, but Skynet does as Skynet does.

sharmavinu0024 4y ago

google doc. is well used for typing.

greggsy 4y ago

Presumably people will start running having all sorts of fun fuzzing Google Docs now that they know that it’s not an infallible, opaque product… Any web app pentesters here willing throw in their 2c? Could this offer insights into the way data is parsed in the backend, or might result in something more interesting than a crash?

the_snooze 4y ago

Parsing arbitrary user-provided input? What could possibly go wrong?