Note: this also works: http://www.google.com/#q=$%7B
Break Google
21–30 of 92 posts
Re: Break Google
#22For me just typing ${ breaks the layout. I agree it probably has something to do with a template engine. I know Java EL uses the syntax ${variable_name} and so does Velocity Templates.
The bug doesn't exist on https://encrypted.google.com/
Re: Break Google
#23When you search for "${", the page is missing 26 lines of minified JavaScript (lines 9-35 of a non-broken page, at least for me), almost certainly because of a templating bug. These lines, among other things, are responsible for adding the top toolbar to the page. (The missing JS is here: http://pastebin.com/B9cy3T2c )
I think google search uses this templating language:
http://code.google.com/p/google-ctemplate/
It makes sense that the ${ could cause problems.
Re: Break Google
#24Seems likely that it's due to a lack of escaping in a custom templating layer. I wonder if it could be used to perform a XSS attack?
Unlikely. You'd have to get someone else to run the same query.
...which you can do simply by posting a link anywhere.
Edit: I guess it would be more helpful to explain why for those not familiar with XSS. If all it takes it a specially crafted URL to your site to exploit it, your site is toast. The security model of the web assumes that people can open even the shadiest of links without negative consequences. I could have obscured the URL with a shortener and named the link "Cutest cat pic ever!" I could have hosted a page on a totally separate domain and put the crafted URL in a hidden iframe. All I have to do is send document.cookie over to my server and now I control your account.
Re: Break Google
#25Earlier quoted context omitted.
Unlikely. You'd have to get someone else to run the same query.
...which you can do simply by posting a link anywhere. Edit: I guess it would be more helpful to explain why for those not familiar with XSS. If all it takes it a specially crafted URL to your site to exploit it, your site is toast. The security model of the web assumes that people can open even the shadiest of links without negative consequences. I could have obscured the URL with a shortener and named the link "Cut…
Or iframe it.
Re: Break Google
#26Earlier quoted context omitted.
Unlikely. You'd have to get someone else to run the same query.
...which you can do simply by posting a link anywhere. Edit: I guess it would be more helpful to explain why for those not familiar with XSS. If all it takes it a specially crafted URL to your site to exploit it, your site is toast. The security model of the web assumes that people can open even the shadiest of links without negative consequences. I could have obscured the URL with a shortener and named the link "Cut…
My mistake. I thought it didn't work if you linked to it directly. It turns out the bug just manifests itself differently if you do that.
Re: Break Google
#27Also works if you use the html code: "${"
It returns the symbol instead of the search query.
Re: Break Google
#28Say , what you want about bing , i support it . At least typing in random strings like "${" wont break the webpage .
(if you hate Microsoft and want to down vote this comment, go ahead . I don't care )
Re: Break Google
#29Say , what you want about bing , i support it . At least typing in random strings like "${" wont break the webpage .
(if you hate Microsoft and want to down vote this comment, go ahead . I don't care )
Re: Break Google
#30On a related note, searches for many symbols do not product results. Searching for '&' will bring up results for ampersand, but most others that map well to words do not, e.g. $ => dollar, % => percent, etc.