HackerOne: profile cover can also load external URL's

2015-11-14T17:48:38
ID H1:99687
Type hackerone
Reporter smiegles
Modified 2015-12-02T10:48:08

Description

Hi,

I have to option to change my cover background (https://hackerone.com/{program_name}/edit). When I insert #360e0e url('http://www.google.com') as background "color" it will make a connection to http://www.google.com (If IE is used).

I can't save it so it won't affect any other people but it doesn't look "by design".

Kind regards,

Olivier