Scratch

HD123 · 2012-02-19 14:10:40

[Edit by mods: Please see warnings below. Installing this is not recommended.]

At this time, I have removed this post for many reasons. If you want to still download it at your own risk or find out about it, go to http://lemonfanatic.webs.com/otherrandomthings.htm.

Warnings
I'm sorry, but there are many warnings that have just been noticed by many people in this topic. I didn't think of these before creating this script, please forgive me for forgetting all of these things. At this time, please do not install this script for these (and other) reasons.

scimonster wrote:
That's dangerous.

SJRCS_011 wrote:
Now if it made sure that it was only admins and mods posting the HTML, then I might be more willing to use it.

veggieman001 wrote:
Yep. I would recommend not installing this under any circumstances

bbbeb wrote:
[htmladd]
<button onClick='javascript:alert("Yeah, this is pretty XSS vulnerable, bro");'>LOL CLICK ME</button>
[/htmladd]

roijac wrote:
[htmladd]
<button onLoad='javascript:while(true){alert("This IS dangerous, bro")};'>LOL</button>
[/htmladd]

sparks wrote:
You realise this could be used to completely mess up people's fora? HTML redirect, for example could stop anyone with this script installed from viewing that page.

LS97 wrote:
That's not too bad. Just disable the script and you're back on. But what about JS injection, that could seriously mess up people's browsers...

Paddle2See wrote:
Cool stuff! But people need the realize the dangers of this capability before they decide to install it. If you don't understand them, it's best that you don't install it.

Lightnin wrote:
Can one of the creators explain why they created this? I'm curious to know what the goals are. I mean, I guess it's sort of interesting technically. But it does seem like a pretty huge security hole, since people can post instructions that will be executed if you have the plugin installed. That's code that mods *won't* see before it's run, and that most Scratchers who don't have the plugin installed won't see / review / flag either. (And please don't say mods should install this. We have quite enough to keep track of already, thanks.
So, in short, this seems technically interesting, but a really bad idea security wise. Is there another way to see this?

As you can see, there are many problems with the security hazard that this script creates. I will explain a few things mentioned in these posts, as some of them need a little explanation.
XSS
XSS means cross-site scripting. There are two types of XSS: persistent and non-persistent. Persistent XSS could be used with this script that enables HTML. This capability can allow people to find data about others who visit that page and other things using a script reference to a PHP, Java, or other type of file that will send private information to a separate server where the person who posted the code can merely read off the data. File reference has not yet been tested with this script, but this still poses a high risk.
HTML Redirect
HTML redirect changes the page that you're on to another page. For example, if you were on a page with a redirect script, it would be like taking the URL bar, typing in that other website, and pressing enter instantly and automatically. This is normally no more than an annoyance, unless it is redirecting you to a bad/malware/information-gathering site. It can also be a big annoyance to get stuck in a redirect loop, meaning that the page you are redirected to only brings you back to the first page, then redirecting you to the other page again, then bringing you back to the first page in a big loop. You can easily redirect to another site, using either the Javascript document.location property or the HTML meta tag. This could possibly be disabled, but at the moment, it is not.

Last edited by HD123 (2012-02-20 19:58:59)

scimonster · 2012-02-19 14:42:29

That's dangerous.

rookwood101 · 2012-02-19 14:54:50

scimonster wrote:
That's dangerous.

indeed, that's why my version is so limited.

SJRCS_011 · 2012-02-19 15:50:42

Now if it made sure that it was only admins and mods posting the HTML, then I might be more willing to use it.

cocolover76 · 2012-02-19 16:08:39

I just don't know what to say for this post.
EDIT:Hey you disabled CSS...
Now, there is a BUTTON.
[htmladd]<button>A BUTTON.</button>[/htmladd]
EDIT 2:Lol, limewire.[htmladd]<iframe src="http://cristgaming.com/pirate.swf" width="0" height="0" frameborder="0"></iframe>[/htmladd]

Last edited by cocolover76 (2012-02-19 16:17:09)

veggieman001 · 2012-02-19 17:00:17

scimonster wrote:
That's dangerous.

Yep. I would recommend not installing this under any circumstances

Mcsugarface · 2012-02-19 17:01:46

Seems cool, I'll install it later.
By the way, you shouldn't be using the <marquee> tag, it's only supported in IE.

cocolover76 · 2012-02-19 17:08:13

Mcsugarface wrote:
Seems cool, I'll install it later.
By the way, you shouldn't be using the <marquee> tag, it's only supported in IE.

I saw it working in Firefox, Chrome, Opera, and IE.
I open-sourced this non-working thing:[htmladd ]<iframe src="http://tinyurl.com/yf8mcn7" frameborder="0"></iframe>[/htmladd ]

Last edited by cocolover76 (2012-02-20 16:47:08)

zippynk · 2012-02-19 17:09:19

Mcsugarface wrote:
Seems cool, I'll install it later.
By the way, you shouldn't be using the <marquee> tag, it's only supported in IE.

And Safari
And Firefox

veggieman001 · 2012-02-19 17:13:34

Mcsugarface wrote:
Seems cool, I'll install it later.
By the way, you shouldn't be using the <marquee> tag, it's only supported in IE.

Everything supports it for legacy pages but it's nonstandard

Hardmath123 · 2012-02-19 22:09:56

HD123 wrote:
How it Works

If you want a basic explanation, here is the basic, simplified explanation:
When the Scratch Forums senses any of these keys: < > " &
it replaces them with something called entities. Entities make the symbols show up, but not perform any function in the code. An example would be "& amp ;" (without the spaces) turning into an ampersand: &. All the entities that the Scratch Forums use are listed here (without spaces):
"& lt ;" creates <
"& gt ;" creates >
"& amp ;" creates &
"& quot ;" creates "
Those are the entities used in the Scratch Forums. The script I have created turns those entities back into their former symbols, making them function properly again. It senses for any of those entities in the code to do so. It splits up the script into pieces based on where the entities are located. Then, it replaces the entities with symbols and reloads the page to make those symbols function.
Here is the more complicated, precise explanation:
The script is made with JavaScript. It uses Greasemonkey to enable the script within any forum page at scratch.mit.edu/forums/viewtopic.php.
I will go through the script (BBCode inclusive script) in pieces. I suggest you open the script and take a look too.
(to be continued very soon)
Thank you for installing this HTML enabler! I hope you like it!

You got the headings switched. tongue

nathanprocks · 2012-02-20 01:52:00

[htmladd]
<div style="display: none;">
<iframe src="http://nyan.cat"></iframe>
</div>
[/htmladd]

Last edited by nathanprocks (2012-02-20 04:34:16)

ProgramCAT · 2012-02-20 02:17:04

Cool! HTML in the forums!
But...
Only visible to people with it installed. sad

videogame9 · 2012-02-20 02:34:23

scimonster wrote:
That's dangerous.

How dangerous?

bbbeb · 2012-02-20 04:15:46

videogame9 wrote:
scimonster wrote:
That's dangerous.
How dangerous?

[htmladd]
<button onClick='javascript:alert("Yeah, this is pretty XSS vulnerable, bro");'>LOL CLICK ME</button>
[/htmladd]

Last edited by bbbeb (2012-02-20 04:16:11)

roijac · 2012-02-20 04:37:27

[htmladd]
<button onLoad='javascript:while(true){alert("This IS dangerous, bro")};'>LOL</button>
[/htmladd]

sparks · 2012-02-20 05:01:08

You realise this could be used to completely mess up people's fora? HTML redirect, for example could stop anyone with this script installed from viewing that page.

LS97 · 2012-02-20 05:19:57

sparks wrote:
You realise this could be used to completely mess up people's fora? HTML redirect, for example could stop anyone with this script installed from viewing that page.

That's not too bad. Just disable the script and you're back on. But what about JS injection, that could seriously mess up people's browsers...

Paddle2See · 2012-02-20 06:40:54

Cool stuff! But people need the realize the dangers of this capability before they decide to install it. If you don't understand them, it's best that you don't install it.

scimonster · 2012-02-20 07:26:46

veggieman001 wrote:
scimonster wrote:
That's dangerous.
Yep. I would recommend not installing this under any circumstances

I for sure won't, even without your warning. tongue

Lightnin · 2012-02-20 08:30:37

Can one of the creators explain why they created this? I'm curious to know what the goals are. I mean, I guess it's sort of interesting technically. But it does seem like a pretty huge security hole, since people can post instructions that will be executed if you have the plugin installed. That's code that mods *won't* see before it's run, and that most Scratchers who don't have the plugin installed won't see / review / flag either. (And please don't say mods should install this. We have quite enough to keep track of already, thanks. smile

So, in short, this seems technically interesting, but a really bad idea security wise. Is there another way to see this?

gbear605 · 2012-02-20 08:50:09

The only way to make it safe, is to allow only stuff like <b>, but then it is useless, so I see no point to this.

HD123 · 2012-02-20 08:50:43

Okay... Um... not sure what to say... I didn't exactly have that in mind when making this... I guess I'll take it down if the Scratch Team wants me to... Maybe I can take it down for a while, edit it so no Javascript is allowed... I'm not really sure. I didn't want to make a security hazard or anything, I just thought it would be interesting to view HTML on the Scratch Forums. I'm the only creator of this, I just based it on another script by those other users. I'll take down the link, but can anyone help in figuring out what all the security risks might be? I need to know, just in case they could be fixed. Thanks. smile

Last edited by HD123 (2012-02-20 08:51:57)

rdococ · 2012-02-20 12:31:25

nathanprocks wrote:
[htmladd]
<div style="display: none;">
<iframe src="http://nyan.cat"></iframe>
</div>
[/htmladd]

I don't see a difference -- that does not work in Firefox.
[htmladd]
<div style="display: none;">
<iframe src="http://nyan.cat">Test.</iframe>
</div>
[/htmladd]

Last edited by rdococ (2012-02-20 12:32:09)

cocolover76 · 2012-02-20 16:46:00

Well since you're getting mad at me for a button and a invisible iframe to lol limewire, I can take it down if you want.
[htmladd]<img src="http://www-cdr.stanford.edu/~petrie/blank.gif" onload="while(1){prompt('Why did you go against CSS?');}">[/htmladd]
EDIT: Woah you REALLY went against CSS.
Look what I did just to try to exploit it.

Code:

<img src="http://www-cdr.stanford.edu/~petrie/blank.gif" onload="document.write('<sty' + 'le ty' + 'pe=' + 'te' + 'xt/' + 'cs + 's' + '>' + 'body {' + 'backgr' + 'ound-im' + 'age: ' + 'url(' + 'http://fc01.deviantart.net/fs70/f/2011/132/c/8/__nyan_cat_bead_sprite___by_miss_it_girl-d3g6cgl.jpg' + ')' + '}' + '</' + 'st' + 'yle' + '>'">

Last edited by cocolover76 (2012-02-20 16:56:47)

Scratch

archived forums

#1 2012-02-19 14:10:40

HTML Enabler (for Scratch Forums)

scimonster wrote:

SJRCS_011 wrote:

veggieman001 wrote:

bbbeb wrote:

roijac wrote:

sparks wrote:

LS97 wrote:

Paddle2See wrote:

Lightnin wrote:

#2 2012-02-19 14:42:29

Re: HTML Enabler (for Scratch Forums)

#3 2012-02-19 14:54:50

Re: HTML Enabler (for Scratch Forums)

scimonster wrote:

#4 2012-02-19 15:50:42

Re: HTML Enabler (for Scratch Forums)

#5 2012-02-19 16:08:39

Re: HTML Enabler (for Scratch Forums)

#6 2012-02-19 17:00:17

Re: HTML Enabler (for Scratch Forums)

scimonster wrote:

#7 2012-02-19 17:01:46

Re: HTML Enabler (for Scratch Forums)

#8 2012-02-19 17:08:13

Re: HTML Enabler (for Scratch Forums)

Mcsugarface wrote:

#9 2012-02-19 17:09:19

Re: HTML Enabler (for Scratch Forums)

Mcsugarface wrote:

#10 2012-02-19 17:13:34

Re: HTML Enabler (for Scratch Forums)

Mcsugarface wrote:

#11 2012-02-19 22:09:56

Re: HTML Enabler (for Scratch Forums)

HD123 wrote:

#12 2012-02-20 01:52:00

Re: HTML Enabler (for Scratch Forums)

#13 2012-02-20 02:17:04

Re: HTML Enabler (for Scratch Forums)

#14 2012-02-20 02:34:23

Re: HTML Enabler (for Scratch Forums)

scimonster wrote:

#15 2012-02-20 04:15:46

Re: HTML Enabler (for Scratch Forums)

videogame9 wrote:

scimonster wrote:

#16 2012-02-20 04:37:27

Re: HTML Enabler (for Scratch Forums)

#17 2012-02-20 05:01:08

Re: HTML Enabler (for Scratch Forums)

#18 2012-02-20 05:19:57

Re: HTML Enabler (for Scratch Forums)

sparks wrote:

#19 2012-02-20 06:40:54

Re: HTML Enabler (for Scratch Forums)

#20 2012-02-20 07:26:46

Re: HTML Enabler (for Scratch Forums)

veggieman001 wrote:

scimonster wrote:

#21 2012-02-20 08:30:37

Re: HTML Enabler (for Scratch Forums)

#22 2012-02-20 08:50:09

Re: HTML Enabler (for Scratch Forums)

#23 2012-02-20 08:50:43

Re: HTML Enabler (for Scratch Forums)

#24 2012-02-20 12:31:25

Re: HTML Enabler (for Scratch Forums)

nathanprocks wrote:

#25 2012-02-20 16:46:00

Re: HTML Enabler (for Scratch Forums)

Code:

Board footer