[Security] JS challenges vulnerable to XSS

Update: Details hidden, by mod. Update: Details disclosed, by mod.

Hi! Love the purpose of this project but it seems the way some of the JS challenges are set up makes it vulnerable to XSS.

Challenge Name

At least https://www.freecodecamp.org/challenges/sum-all-primes and https://www.freecodecamp.org/challenges/smallest-common-multiple, if not all JS challenges.

Issue Description

JS challenges appear to be vulnerable to XSS via injection in the URL. Examples: https://www.freecodecamp.org/challenges/sum-all-primes#?solution=alert('xss') https://www.freecodecamp.org/challenges/smallest-common-multiple#?solution=alert('xss')

If signed in, observe that alert('xss') executes.

Browser Information

Chrome, but should affect all browsers with appropriate escaping.

I’m not sure how dangerous session hijacking is to your site but thought it’d be worth pointing out. Let me know what you think.

[raisedadead]

We have fixed this in production. As a side effect, the sharing code URLs from profile, and viewing solutions from profiles is disabled.

This is side effect is temporary and is already handled more elegantly in the beta.

We will soon be adding a more clear warning notice on the profile page, for clarification.

Note: none of the progress is lost, and all submitted solutions are safe in the user’s profiles, except we are temporarily limiting the ability to view and share them.

[linkenneth]

Thanks for the fix! Verified that the issue as it was no longer works. Sorry again for the irresponsible disclosure, hope it didn’t cause too much trouble.