Do you use tappedout? If you're like me, you know it's always been a way to easily organize and sort decks and you've made great use over the years.
Apparently, their html coding is no longer safe and is posing a security vulnerability, so heads up, use at your own risk.
Tappedout Security Risk
Community Rules
‖ Commander Rules
-
3drinks Kaalia's Personal Liaison
- Posts: 4832
- Joined: 4 years ago
- Pronoun: he / him
- Location: Ruined City of Drannith, Ikoria
Steel Sabotage'ng Orbs of Mellowness since 2011.
Modern
87guide Burn
87guide Burn
Commander
Kellan, the Fae-Blooded // Birthright Boon (local secret santa gift)
Torbran, Thane of Red Fell (Red Deck Wins)
Alesha, Who Smiles at Death (Slivers)
Kaalia HQ
Kellan, the Fae-Blooded // Birthright Boon (local secret santa gift)
Torbran, Thane of Red Fell (Red Deck Wins)
Alesha, Who Smiles at Death (Slivers)
Kaalia HQ
-
Rorseph Compleat Fool
- Posts: 147
- Joined: 4 years ago
- Pronoun: they / them
- Location: The Sixth Sphere of Phyrexia
- Contact:
If that's the case, I guess I'm speeding up my personal migration to Archidekt. Do you have a source with more information?
"From void evolved Phyrexia. Great Yawgmoth, Father of Machines, saw its perfection. Thus The Grand Evolution began."
—Phyrexian Scriptures
Aurelia | Maelstrom Wanderer | Primer: Thassa | Uro | Primer: Volrath
—Phyrexian Scriptures
Aurelia | Maelstrom Wanderer | Primer: Thassa | Uro | Primer: Volrath
-
3drinks Kaalia's Personal Liaison
- Posts: 4832
- Joined: 4 years ago
- Pronoun: he / him
- Location: Ruined City of Drannith, Ikoria
I only heard of it in our Kaalia server on Discord. I don't know what I'd be looking for to confirm personally.
Steel Sabotage'ng Orbs of Mellowness since 2011.
Modern
87guide Burn
87guide Burn
Commander
Kellan, the Fae-Blooded // Birthright Boon (local secret santa gift)
Torbran, Thane of Red Fell (Red Deck Wins)
Alesha, Who Smiles at Death (Slivers)
Kaalia HQ
Kellan, the Fae-Blooded // Birthright Boon (local secret santa gift)
Torbran, Thane of Red Fell (Red Deck Wins)
Alesha, Who Smiles at Death (Slivers)
Kaalia HQ
-
Rorseph Compleat Fool
- Posts: 147
- Joined: 4 years ago
- Pronoun: they / them
- Location: The Sixth Sphere of Phyrexia
- Contact:
Considering that this thread is the first Google result for "tappedout security risk", maybe we should be careful about verifying this as factual before anything else.
"From void evolved Phyrexia. Great Yawgmoth, Father of Machines, saw its perfection. Thus The Grand Evolution began."
—Phyrexian Scriptures
Aurelia | Maelstrom Wanderer | Primer: Thassa | Uro | Primer: Volrath
—Phyrexian Scriptures
Aurelia | Maelstrom Wanderer | Primer: Thassa | Uro | Primer: Volrath
They don't properly sanitize all of the user-driven output.
A Dev friend did a proof of concept <script> injection (it just created an alert popup), and pointed it out to them. They never responded. To my knowledge they haven't fixed the issue (but hopefully I'm wrong).
A Dev friend did a proof of concept <script> injection (it just created an alert popup), and pointed it out to them. They never responded. To my knowledge they haven't fixed the issue (but hopefully I'm wrong).
To the beaten, the broken, or the damned; the lost, and the wayward: wherever I may be, you will have a home.
-
3drinks Kaalia's Personal Liaison
- Posts: 4832
- Joined: 4 years ago
- Pronoun: he / him
- Location: Ruined City of Drannith, Ikoria
That's pretty dangerous, yeah?
Steel Sabotage'ng Orbs of Mellowness since 2011.
Modern
87guide Burn
87guide Burn
Commander
Kellan, the Fae-Blooded // Birthright Boon (local secret santa gift)
Torbran, Thane of Red Fell (Red Deck Wins)
Alesha, Who Smiles at Death (Slivers)
Kaalia HQ
Kellan, the Fae-Blooded // Birthright Boon (local secret santa gift)
Torbran, Thane of Red Fell (Red Deck Wins)
Alesha, Who Smiles at Death (Slivers)
Kaalia HQ
If their site was targeted by a bad actor and you visited their deck, they could inject cross site scripting that could be bad. But hopefully they fixed the issue (or a new nudge will get them to)
Edit: I just confirmed the issue is still alive.
I'll email them and give them another nudge
Edit: I just confirmed the issue is still alive.
I'll email them and give them another nudge
To the beaten, the broken, or the damned; the lost, and the wayward: wherever I may be, you will have a home.
Tapped out is good people, and missing a sanitation happens to everyone.
To the beaten, the broken, or the damned; the lost, and the wayward: wherever I may be, you will have a home.
-
3drinks Kaalia's Personal Liaison
- Posts: 4832
- Joined: 4 years ago
- Pronoun: he / him
- Location: Ruined City of Drannith, Ikoria
That's great to see.
Steel Sabotage'ng Orbs of Mellowness since 2011.
Modern
87guide Burn
87guide Burn
Commander
Kellan, the Fae-Blooded // Birthright Boon (local secret santa gift)
Torbran, Thane of Red Fell (Red Deck Wins)
Alesha, Who Smiles at Death (Slivers)
Kaalia HQ
Kellan, the Fae-Blooded // Birthright Boon (local secret santa gift)
Torbran, Thane of Red Fell (Red Deck Wins)
Alesha, Who Smiles at Death (Slivers)
Kaalia HQ