Announcement: Viewing and sharing solutions from user profiles is temporarily disabled

Earlier yesterday we were made aware of an issue about an XSS vulnerability on some JS Challenges.
We have fixed this in production.

As a side effect, the sharing code URLs from profile, and viewing solutions from profiles is disabled.

This is side effect is temporary and is already handled more elegantly in the beta.

We will soon be adding a more clear warning notice on the profile page, for clarification.

Note: none of the progress is lost, and all submitted solutions are safe in the user’s profiles, except we are temporarily limiting the ability to view and share them.

For details you may refer [Security] JS challenges vulnerable to XSS ¡ Issue #16510 ¡ freeCodeCamp/freeCodeCamp ¡ GitHub

Update 1:

  1. This only affects viewing solutions from user profiles, view solution link or any link that is shared to you.
  2. Your solution will be loaded from a local storage copy, if its available there. Meaning, as long as you have not changed computers or cleared you local storage / cookies, your solution will be loaded automatically from there.

Update 2:

We have prepared a fix, and hopefully we will have this on the main site, soon. Just wanted to let you know of our progress:


Update 3:

We have patched the platform to enable viewing solutions once again. Happy coding!

4 Likes

Update:

  • We are working on a fix to enable safe viewing of the solutions. However we can not give an accurate timeline at this moment.
  • Please bear with us, and drop your queries in here.

/cc @kevcomedia @michaelhenderson

1 Like

What if my solutions weren’t even saving in the first place?

That makes no sense John. Elaborate. I can see your projects saved on your profile: https://www.freecodecamp.org/anonymouslords

I remembered @jacksonbates made a solution downloader a few months ago.

Link to app: https://freecodecamp-solutions.herokuapp.com/
UPDATE. A recent update has broken this tool. See below.

I tried it and was able to view my solutions. Can we present this as an alternative for now?

Hi @kevcomedia

Thanks for sharing this, I’ll take a look.

Could you also test is out with @JacksonBates and confirm how it can be integrated on the production? If possible layout a action plan, we will be happy to integrate it on our core platform.

A simple POC and explanation on the tracker should be fine, we will work on a PR.

Do challenges or anything also save ?

When you click the Submit and go to my next challenge (after Run tests, has been done successfully), it is saved in your profile on the database.

Only, viewing this is limited as of now, because of the side effect of a fix that we had to do.

We are actively working on how to restore, the viewing without compromising the fix.

2 Likes

@kevcomedia @JacksonBates we have inadvertently broken this tool with this https://github.com/freeCodeCamp/freeCodeCamp/pull/16552

2 Likes

Thanks for the head’s up :slight_smile:

1 Like

Any update on this, perhaps a timeline? I was hoping to pick FCC back up this week and noticed all my past solutions have vanished but I still have credit for solving. I’m am hopeful that this issue is the cause.

3 Likes

Hi. Why I can’t see my solutions in the Map. Help, please. Thanks.

I can’t see my solutions and progress in my profile as well, any updates on that would be beneficial.
Thanks in advance.

@kevcomedia @ArielLeslie @IsaacAbrahamson just for your FYI

3 Likes

Thanks for the heads up!

We have patched the platform to enable viewing solutions once again. Happy coding!

3 Likes