It is well known* that you can insert somewhat arbitrary HTML into your CF blog or comment and Codeforces will happily render it, but it was only today that I learned you can do this in blog titles too!
I'm sure this is a perfectly sensible and reasonable feature that cannot be abused
| № | Пользователь | Рейтинг |
|---|---|---|
| 1 | Benq | 3792 |
| 2 | VivaciousAubergine | 3647 |
| 3 | Kevin114514 | 3603 |
| 4 | jiangly | 3583 |
| 5 | turmax | 3559 |
| 6 | tourist | 3541 |
| 7 | strapple | 3515 |
| 8 | ksun48 | 3461 |
| 9 | dXqwq | 3436 |
| 10 | Otomachi_Una | 3413 |
| Страны | Города | Организации | Всё → |
| № | Пользователь | Вклад |
|---|---|---|
| 1 | Qingyu | 157 |
| 2 | adamant | 153 |
| 3 | Um_nik | 147 |
| 4 | Proof_by_QED | 146 |
| 5 | Dominater069 | 145 |
| 6 | errorgorn | 141 |
| 7 | cry | 139 |
| 8 | YuukiS | 135 |
| 9 | TheScrasse | 134 |
| 10 | chromate00 | 133 |
One might even say it's a sus feature
... sorry, I'll leave.
mohagus
It seems there's some sort of filter, <script> and stuff don't work. But embeds do work:
lol it's funny how the image expands with the spoiler
It just is
My Blogs after this learning it..
Please don't show this to anyone :)
Preview:
Full:
Edit : nice feature and also it seems like when you try to write XSS script in js, it removes some dangerous codes while rendering it
InnerHTML has nothing to do with this.
There is definitely some sanitization going on, e.g. you can't use a
<script>tag. But it seems there was a conscious decision to allow most HTML, possibly they decided Markdown wasn't sufficient.