Potential XSS attack detected

[oldnumberseven]

Hi there

I'm in the middle of updating my story and after editing the 3rd chapter in a row, I got this error.

 

[Ronnie Deaver]

Thanks

Hi there

I'm in the middle of updating my story and after editing the 3rd chapter in a row, I got this error.

View attachment 12

Thanks so much for reporting this!

We'll look into your unique case ASAP.

About 6 months ago Fanfiction.net was hacked by having malicious code included in writer's stories - we decided to proactively combat the issue by upping our security, but unfortunately the systems do sometimes have false positives.... which we're taking on a case by case basis.


I'll get back to you when I know more and thanks again for posting here about this!

-Ronnie

 

[oldnumberseven]

Yeah, no problem! I figured it had to do with me updating a bunch of my chapters at once Sorry to hear about the attack! I've managed sites before and that's never fun.

 

[Ronnie Deaver]

Yeah, no problem! I figured it had to do with me updating a bunch of my chapters at once Sorry to hear about the attack! I've managed sites before and that's never fun.

It has less to do with updating the stories and more to do with the content within them - for example, older versions of word often included hidden <script> commands during a copy paste into our systems. Since the XSS warning system was implemented after your story was posted, it was unaffected until you attempted to update them.

Hope that makes sense !

 

[oldnumberseven]

It has less to do with updating the stories and more to do with the content within them - for example, older versions of word often included hidden <script> commands during a copy paste into our systems. Since the XSS warning system was implemented after your story was posted, it was unaffected until you attempted to update them.

Hope that makes sense !

Ahhhhh ok. Yes that makes sense

 

[Ronnie Deaver]

Ahhhhh ok. Yes that makes sense

Turns out this is actually a legitimate XSS attack (Non intentional)

the HTML is the text they uploaded. it looks like it's copying the whole HTML structure including the chapter navigation UI from a different site

there's an "onclick" attribute on the dropdown menu that changes the url to "/story_preview.php?storyid=...")


Fortunately, that means fixing it is pretty easy... just copy paste ONLY the text of your story and not the entire site its hosted on now.

Let me know if you have any further questions or problems!

-Ronnie

 

[oldnumberseven]

Aha! That makes sense, I've been copying and pasting from the same story on FF.net.

Just to double check, if I have an older version of word and copy/paste, will I run into the same issue?

 

[Ronnie Deaver]

Aha! That makes sense, I've been copying and pasting from the same story on FF.net.

Just to double check, if I have an older version of word and copy/paste, will I run into the same issue?

Nope! We've whitelisted the majority of scripts that old Word uses.

I'm glad to find at least one case where our system prevented a legitimate danger to our site - FF.net was the original site to get hacked, so now I know our measures were effective at preventing exactly this scenario (this is how it spread across fandom in the first place)

 

[Stella Blue]

Hi Ronnie - I've been having this same issue as well. After reading the suggestions above I tried deleting all the text of the chapter and repasting it in from Word, but that didn't change anything. How else can I fix it?
Thanks!

 

[Ronnie Deaver]

Hi Ronnie - I've been having this same issue as well. After reading the suggestions above I tried deleting all the text of the chapter and repasting it in from Word, but that didn't change anything. How else can I fix it?
Thanks!

Sounds like you found a new one and came to the right place!

We're looking into it now!

-R

 

[Ronnie Deaver]

Hi Ronnie - I've been having this same issue as well. After reading the suggestions above I tried deleting all the text of the chapter and repasting it in from Word, but that didn't change anything. How else can I fix it?
Thanks!

Could you try posting your story one more time?

Thank you
-R

 

[Stella Blue]

Could you try posting your story one more time?

Thank you
-R

I just tried, and got the same error again :-/

 

[Ronnie Deaver]

I just tried, and got the same error again :-/

Thank you! We added some special tracking code to your story so we could hunt down the issue. I'll get back to you ASAP

-R

 

[Stella Blue]

Thank you! We added some special tracking code to your story so we could hunt down the issue. I'll get back to you ASAP

-R

Just wondering if the issue has been fixed yet?

 

[Ronnie Deaver]

Hey there,

Thanks for the follow up on this. We did continue looking into this and made another change. I'm assuming you're still experiencing the same issue having tried again within the last week?

-Ronnie

 

[Stella Blue]

It seems to be working now, on my phone at least Thank you!!

 

[Ronnie Deaver]

It seems to be working now, on my phone at least Thank you!!

Huzzah!!!! Glad it worked - Ronnie