51–60 of 92 posts
> Shortest way to produce issue is here — http://google.com/#q=$ { Making it an actual hyperlink would've been a bit shorter.
the bug exists only by searching on the google homepage, searching it on the searchbar of the browser doesn't happen.
When you search for "${", the page is missing 26 lines of minified JavaScript (lines 9-35 of a non-broken page, at least for me), almost certainly because of a templating bug. These lines, among other things, are responsible for adding the top toolbar to the page. (The missing JS is here: http://pastebin.com/B9cy3T2c )
I think google search uses this templating language: http://code.google.com/p/google-ctemplate/ It makes sense that the ${ could cause problems.
Earlier quoted context omitted.
I think google search uses this templating language: http://code.google.com/p/google-ctemplate/ It makes sense that the ${ could cause problems.
In my experience it's pretty rare for template language bugs to cause errors if user entered content includes one of their special characters. The template would have to be evaluated twice for any problems to occur - once to insert the user's template code in to placeholders within the original template , and then once again to execute the resulting combination.
Minimal reproduction:
Mustache.to_html('{{b}}', {b: '{{c}x}' }) -> '{{c}x}'
Mustache.to_html('{{#a}}{{b}}{{/a}}', {a: [{b: '{{c}x}' }]}) -> '{{c}x}'
Mustache.to_html('{{b}}', {b: '{{c}}' }) -> '{{c}}'
Mustache.to_html('{{#a}}{{b}}{{/a}}', {a: [{b: '{{c}}' }]}) -> '' (wrong)https://encrypted.google.com/#q=${
looks fine, but
http://www.google.com/search?sourceid=chrome&ie=UTF-8...{
doesn't.
Tip to the poster, and to anyone: Google (and Facebook, and others) have bug bounty programs. You can get paid tens to thousands of dollars if you report vulns to the vendor first.
Pretty low bounty. The base reward for qualifying bugs is $500. If the rewards panel finds a particular bug to be severe or unusually clever, rewards of up to $3,133.7 may be issued. http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w...
Either google is very confident that they don't have serious bugs or they are setting themselves up for a problem. Imagine the value of finding a serious bug in adsense or adwords.
Imagine how much easier life would be if in HTML we only had to filter for § instead of escape every and ".
If your templating language is going to use a magic character it would seem useful to pick something less common than $. There are several odd characters on my keyboard (§`~±|¤) and if you are willing to use the ALT key there are really obscure characters that you can safely filter from the input instead of going through the trouble of escaping them. Filtering is so much more efficient/easier/safer than escaping. Ima…
http://www.proweb.co.uk/~matt for instance