Potential XSS attack detected

Ronnie Deaver

HPFF Logistical CoFounder
Staff member
Thanks
Hi there :p

I'm in the middle of updating my story and after editing the 3rd chapter in a row, I got this error.

View attachment 12
Thanks so much for reporting this!

We'll look into your unique case ASAP.

About 6 months ago Fanfiction.net was hacked by having malicious code included in writer's stories - we decided to proactively combat the issue by upping our security, but unfortunately the systems do sometimes have false positives.... which we're taking on a case by case basis.


I'll get back to you when I know more and thanks again for posting here about this!

-Ronnie
 

oldnumberseven

New member
Yeah, no problem! I figured it had to do with me updating a bunch of my chapters at once :) Sorry to hear about the attack! I've managed sites before and that's never fun.
 

Ronnie Deaver

HPFF Logistical CoFounder
Staff member
Yeah, no problem! I figured it had to do with me updating a bunch of my chapters at once :) Sorry to hear about the attack! I've managed sites before and that's never fun.
It has less to do with updating the stories and more to do with the content within them - for example, older versions of word often included hidden <script> commands during a copy paste into our systems. Since the XSS warning system was implemented after your story was posted, it was unaffected until you attempted to update them.

Hope that makes sense :)!
 

oldnumberseven

New member
It has less to do with updating the stories and more to do with the content within them - for example, older versions of word often included hidden <script> commands during a copy paste into our systems. Since the XSS warning system was implemented after your story was posted, it was unaffected until you attempted to update them.

Hope that makes sense :)!
Ahhhhh ok. Yes that makes sense :cool:
 

Ronnie Deaver

HPFF Logistical CoFounder
Staff member
Ahhhhh ok. Yes that makes sense :cool:
Turns out this is actually a legitimate XSS attack (Non intentional)

the HTML is the text they uploaded. it looks like it's copying the whole HTML structure including the chapter navigation UI from a different site

there's an "onclick" attribute on the dropdown menu that changes the url to "/story_preview.php?storyid=...")



Fortunately, that means fixing it is pretty easy... just copy paste ONLY the text of your story and not the entire site its hosted on now.

Let me know if you have any further questions or problems!

-Ronnie
 

oldnumberseven

New member
Aha! That makes sense, I've been copying and pasting from the same story on FF.net.

Just to double check, if I have an older version of word and copy/paste, will I run into the same issue?
 

Ronnie Deaver

HPFF Logistical CoFounder
Staff member
Aha! That makes sense, I've been copying and pasting from the same story on FF.net.

Just to double check, if I have an older version of word and copy/paste, will I run into the same issue?
Nope! We've whitelisted the majority of scripts that old Word uses.

I'm glad to find at least one case where our system prevented a legitimate danger to our site - FF.net was the original site to get hacked, so now I know our measures were effective at preventing exactly this scenario (this is how it spread across fandom in the first place)
 

Stella Blue

New member
Hi Ronnie - I've been having this same issue as well. After reading the suggestions above I tried deleting all the text of the chapter and repasting it in from Word, but that didn't change anything. How else can I fix it?
Thanks!
 

Ronnie Deaver

HPFF Logistical CoFounder
Staff member
Hi Ronnie - I've been having this same issue as well. After reading the suggestions above I tried deleting all the text of the chapter and repasting it in from Word, but that didn't change anything. How else can I fix it?
Thanks!
Sounds like you found a new one and came to the right place!

We're looking into it now!

-R
 

Ronnie Deaver

HPFF Logistical CoFounder
Staff member
Hi Ronnie - I've been having this same issue as well. After reading the suggestions above I tried deleting all the text of the chapter and repasting it in from Word, but that didn't change anything. How else can I fix it?
Thanks!
Could you try posting your story one more time?

Thank you
-R
 

Ronnie Deaver

HPFF Logistical CoFounder
Staff member
Hey there,

Thanks for the follow up on this. We did continue looking into this and made another change. I'm assuming you're still experiencing the same issue having tried again within the last week?

-Ronnie
 
Top