I don't know if this should be on meta or on the Information security stack exchange, so please tell me. With the code snippets feature, you can insert malicious code out of view, and people will likely not notice and execute the code. The code snippets feature is basically allowing you to make a website inside of stack exchange, and although you can view the code before executing, it is still very dangerous.
2
-
1This has been brought up before. The feature was originally introduced on Stack Overflow, so you can find more information about it on Meta Stack Overflow. – Fire Quacker Mar 3 at 17:21
-
1Code snippets are sandboxed to stop evil code, and is on a different domain to stop bad things, and when a post gets a score of -3 or lower then it is greyed out and can't be run. – corn on the cob Mar 6 at 14:19
Add a comment
|
If you have found what you consider to be a vulnerability please use the Contact Us link at the bottom of every page and provide SE with details.
I'm not sure what you are describing is a vulnerability, though.
Be aware that the Stack Exchange sites that allow code snippets are very much for people who will notice, and review the code to see if it suits their needs. They aren't going to be run unwittingly by people.
