That company whose name used to contain HTML script tags Ltd • Hacker News Board

Re: That company whose name used to contain HTML script tags Ltd

#151

Post by Nextgrid » Thu, Oct 29, 2020, 4:40 AM UTC

jsty wrote: post #15

Nice to see Bobby Tables is all grown up. Relevant discussion on the Companies House Developer Forum: https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...

I'm disappointed that the discussion seems more about debating whether that person acted in good faith or that the law regarding acceptable characters in company names should be changed, as opposed to the bigger concern of why were they not sanitizing company names? Even without intent to insert HTML, characters such as would still break their pages.

Re: That company whose name used to contain HTML script tags Ltd

#152

Post by _4gzn » Thu, Oct 29, 2020, 6:34 AM UTC

Here is to the company

  Dariusz Jakubowski x'; DROP TABLE users; SELECT '1

that ran in Poland from 2014 to 2019 [0].

[0] https://prod.ceidg.gov.pl/CEIDG/ceidg.public.ui/SearchDetail... (check the reCAPTCHA and click "Dalej")

Re: That company whose name used to contain HTML script tags Ltd

#153

Post by wodenokoto » Thu, Oct 29, 2020, 7:10 AM UTC

What was the name? It’s former name is listed as “[NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]” and it’s current name doesn’t contain any HTML tags (it’s literally the same as the headline)

Those are both funny and confusing names, but they don’t warrant comparison to sql-injections, so I am guessing there’s another name with actual HTML tags.

Re: That company whose name used to contain HTML script tags Ltd

#154

Post by jtsiskin » Thu, Oct 29, 2020, 8:30 AM UTC

bearbin wrote: post #8

Relevant context: https://twitter.com/zofrex/status/1319286955314614275 Apparently the name used to be \"> LTD

You would think if you go to all the trouble to register a company name, you would at least use a domain you control

Re: That company whose name used to contain HTML script tags Ltd

#155

Post by sandos » Thu, Oct 29, 2020, 8:55 AM UTC

KineticLensman wrote: post #130

saalweachter wrote: post #72

Earlier quoted context omitted.

Back when I worked at a comparison shopping engine, I had a bit of a laugh when I saw that the indexing pipeline was generating error messages because the "clean" function returned empty for some products in the feed from Amazon, because they had names like "++++++". It was usually musical albums that liked to have names that made it impossible for fans to find the music.

> Musical albums that liked to have names The band 'Audiobooks' has taken this to the next level

I like the band A. When I try to find their music though...

https://en.wikipedia.org/wiki/A_(band)

Re: That company whose name used to contain HTML script tags Ltd

#156

Post by daniaal » Thu, Oct 29, 2020, 9:38 AM UTC

This company is class. https://find-and-update.company-information.service.gov.uk/c...

Re: That company whose name used to contain HTML script tags Ltd

#157

Post by tim333 » Thu, Oct 29, 2020, 11:06 AM UTC

pjc50 wrote: post #124

tcgv wrote: post #102

Earlier quoted context omitted.

I was wondering how much it costs to open a company in the UK to do something like that, and it seems to be really cheap (and quick): a) Incorporate directly via Companies House The standard registration fee to set up a company is just £12 for the ‘standard’ Companies House web incorporation service, which takes up to 24 hours to turnaround. You can pay via credit card, debit card or PayPal. Source: https://www.itcon…

Yes, it is. Do they still require a minimum of two officers? (Spam warning: if you form a company at your home address, you will be inundated with paper spam for office equipment. Especially from Dell.)

No. You can do it with one person.

Re: That company whose name used to contain HTML script tags Ltd

#158

Post by tim333 » Thu, Oct 29, 2020, 11:17 AM UTC

blepblep wrote: post #77

bearbin wrote: post #8

Relevant context: https://twitter.com/zofrex/status/1319286955314614275 Apparently the name used to be \"> LTD

Will that even work without http:// or at least // in front of the domain name? Tried it in chrome and sees it as a file name on the current domain.

Seems to have a bit. Cut and paste from the guy who set up \"> LTD

...

>I am in the process of contacting every website that has triggered my script which has a readily available contact for submitting security issues, or a hackerone account or similar. Alas, the sort of websites that have XSS problems rarely list IT security contacts.

Re: That company whose name used to contain HTML script tags Ltd

#159

Post by pbhjpbhj » Thu, Oct 29, 2020, 2:40 PM UTC

r-w wrote: post #119

pbhjpbhj wrote: post #48

For a minute I thought their name was (without the quotes) "[NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]". Seems like a regulation to add "computer code like expressions" to the list that requires prior approval of the Secretary of State might be useful.

That might require a bit more effort on the part of a company I know, who would have to register their logo "moz://a".

That would be a trade mark rather than a company name in this instance I think. In UK registered trademarks are standard type-written letters for word marks. If they contain symbols then they're figurative marks and it's an image of the mark which is registered.

On that point though, searching on the UK trademark registry it looks like it just strips non-alphanumeric symbols. A search for "Moz://a” returns "moza".

Re: That company whose name used to contain HTML script tags Ltd

#160

Post by ashleyn » Thu, Oct 29, 2020, 3:06 PM UTC

jsty wrote: post #15

Nice to see Bobby Tables is all grown up. Relevant discussion on the Companies House Developer Forum: https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...

This reminds me of a story I saw on Reddit once. A man worked for a payment processing firm that didn't sanitize their database inputs at all.

One day, they get a new customer called "Select". Absolutely everything stopped working.