Tappedout Security Risk

[3drinks]

Do you use tappedout? If you're like me, you know it's always been a way to easily organize and sort decks and you've made great use over the years.

Apparently, their html coding is no longer safe and is posing a security vulnerability, so heads up, use at your own risk.

[Rorseph]

If that's the case, I guess I'm speeding up my personal migration to Archidekt. Do you have a source with more information?

[3drinks]

If that's the case, I guess I'm speeding up my personal migration to Archidekt. Do you have a source with more information?

I only heard of it in our Kaalia server on Discord. I don't know what I'd be looking for to confirm personally.

[Rorseph]

Considering that this thread is the first Google result for "tappedout security risk", maybe we should be careful about verifying this as factual before anything else.

[Feyd_Ruin]

They don't properly sanitize all of the user-driven output.
A Dev friend did a proof of concept <script> injection (it just created an alert popup), and pointed it out to them. They never responded. To my knowledge they haven't fixed the issue (but hopefully I'm wrong).

[3drinks]

That's pretty dangerous, yeah?

[Feyd_Ruin]

If their site was targeted by a bad actor and you visited their deck, they could inject cross site scripting that could be bad. But hopefully they fixed the issue (or a new nudge will get them to)

Edit: I just confirmed the issue is still alive.
I'll email them and give them another nudge

[Feyd_Ruin]

Hit him up on discord, this should be fixed soon hopefully.
Tapped out is good people, and missing a sanitation happens to everyone.

[3drinks]

That's great to see.