HexBrain

HackerOne · Report #38232

Breaking Bugs as team member

Validstatus
4upvotes
9 Dec 2014disclosed

How it was found

It is possible to break a bug page (front-end) as a team member. This is how it's done:

  1. Go to a bug.
  2. Select "Change State" -> "Triaged".
  3. Enter a random comment.
  4. Intercept the POST request, change "message" to "message[]".

The status change will be saved but the message will be null (and not ""). This breaks the front-end JavaScript causing the bug page to 'crash' for every participant. In some occasions this broke the entire Bugs page for me.

[Error] TypeError: null is not an object (evaluating 'this.props.raw_message.length')
	(anonymous function) (application-60308a88d636b65f18a684a058b87853.js, line 16)
[Error] TypeError: null is not an object (evaluating 'this.props.raw_message.length')
	perform (application-60308a88d636b65f18a684a058b87853.js, line 14)
	batchedUpdates (application-60308a88d636b65f18a684a058b87853.js, line 12)
	s (application-60308a88d636b65f18a684a058b87853.js, line 13)
	forceUpdate (application-60308a88d636b65f18a684a058b87853.js, line 11)
	(anonymous function) (application-60308a88d636b65f18a684a058b87853.js, line 14)
	c (application-60308a88d636b65f18a684a058b87853.js, line 4)

There is some weird behaviour. In Safari it always fails to load the page, but in Chrome it sometimes works for some reason. Using the steps above, with Safari, you should be able to reproduce the bug.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original