athenahollow

Athena Hollow

@athenahollow

Yep the loud sweary one is here too

Play my stuff http://athenahollow.itch.io
happily married to @failnaut, queer, cis. def has adhd.

log in
athenahollow
@athenahollow
zumphry
@zumphry
tuftedtitmouse
@tuftedtitmouse

i just locked myself (and others!) out of my cohost account oops

turns out zero width spaces are supported in tags and uh. i get this when i log in on @tit

oops.

I'm pretty sure visiting @tit will not work lol.

PSA: save the devs some work and Don't Do That (i'm so sorry)

edit: i am so glad i didn't tag my original post with global feed bc it would've killed it for everyone

edit2: everyone who follows me is also locked out. FUCK

edit3: looks like cohost admins are on the clock starting 9am EST. which is four hours from now. could be worse

tit
@tit

you ever just fuck up?

cohomies, we caught the culprit! pic related it's the culprit (me)

So I was messing around with tags as I noticed apostrophes ended up in urls, unencoded! And I was wondering how other characters would end up in urls.

Well, it turns out that certain characters create a tag that eggbug doesn't like. So I couldn't access cohost anymore beyond the error page pictured.

Later, I realized that, being a tag, this shows up on the post, and therefore also on the feed of other users. Who confirmed that yep, they couldn't reach beyond the Uh Oh! page either.

So if you saw a big Uh Oh! page with eggbug and fire + some cryptic tag error: yep, that was my fault! sorry!

Shoutout to @lexi who devised a way to delete the post through console magicks and techwizardry, to free me and my followers from eternal "eggbug is on fire" doom!

please don't try to replicate this bug / at least not on a public facing account, it doesn't just fuck up your feed but also the feed of other people!
a bug report and an email have been sent to staff to let them know about this

zumphry
@zumphry
This page's posts are visible only to users who are logged in.
log in
You must log in to comment.

in reply to @tuftedtitmouse's post:

two
@two

Oh, that's why I can't scroll down too far on my homepage anymore! I thought for sure that it was the post tagged with the entire EICAR antivirus test file :)

login to reply
two
@two

In all seriousness, this is definitely the funniest Cohost breaking incident I've been victim of so far. Accidentally escalated from CSS crimes to tag-based attacks. It's beautiful.

login to reply
lexi
@lexi

this should do the trick. login as @tit (doesn't matter if you get the error), open the devtools (right click -> inspect element), go to console, and paste this:

fetch("https://cohost.org/api/v1/project/tit/posts/318138", {
  "headers": {
    "accept": "application/json, text/plain, */*",
    "accept-language": "en-DE,en;q=0.9,de-DE;q=0.8,de;q=0.7,en-US;q=0.6",
    "sec-ch-ua": "\"Google Chrome\";v=\"107\", \"Chromium\";v=\"107\", \"Not=A?Brand\";v=\"24\"",
    "sec-ch-ua-mobile": "?0",
    "sec-ch-ua-platform": "\"Windows\"",
    "sec-fetch-dest": "empty",
    "sec-fetch-mode": "cors",
    "sec-fetch-site": "same-origin"
  },
  "referrer": "https://cohost.org/",
  "referrerPolicy": "strict-origin-when-cross-origin",
  "body": null,
  "method": "DELETE",
  "mode": "cors",
  "credentials": "include"
});

this will delete the post which breaks everything. in case you still want the info about the post, here's the post data as JSON and URLEncoded (so it preserves all characters):

%7B%22postId%22%3A318138%2C%22headline%22%3A%22%u200F%u200F%u200Fa%20little%20bit%20of%20fuckery%20with%20tags%20i%20suppose%22%2C%22publishedAt%22%3A%222022-11-16T09%3A16%3A53.507Z%22%2C%22filename%22%3A%22318138-a-little-bit-of-f%22%2C%22transparentShareOfPostId%22%3Anull%2C%22state%22%3A1%2C%22numComments%22%3A0%2C%22cws%22%3A%5B%5D%2C%22tags%22%3A%5B%22%5C%22%5C%22%5C%22%5C%22%5C%22%5C%22%5C%22%5C%22%5C%22%22%2C%22%60%60%60%60%60%60%60%60%60%60%60%60%22%2C%22___________%22%2C%22%u200B%22%2C%22%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%22%2C%22/////////////%22%2C%22%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%5C%22%2C%22%u200F%22%2C%22%u200F%u200F%u200F%u200F%u200F%u200F%u200F%u200F%u200F%u200F%u200F%u200F%u200F%22%2C%22%22%2C%22%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%u200B%22%5D%2C%22hasCohostPlus%22%3Atrue%2C%22pinned%22%3Afalse%2C%22commentsLocked%22%3Afalse%2C%22blocks%22%3A%5B%7B%22type%22%3A%22markdown%22%2C%22markdown%22%3A%7B%22content%22%3A%22%u200F%u200F%u200F%u200F%u200F%u200Fnoticed%20you%20can%20use%20parenthesis%20in%20tags%20which%20show%20up%20in%20urls%20unencoded%20so%20uh.%20hmm%22%7D%7D%2C%7B%22type%22%3A%22markdown%22%2C%22markdown%22%3A%7B%22content%22%3A%22edit%3A%20ooh%2C%20zero%20width%20spaces%20work.%20%5Cnoh%2C%20regular%20spaces%20also%20work%22%7D%7D%5D%2C%22plainTextBody%22%3A%22%u200F%u200F%u200F%u200F%u200F%u200Fnoticed%20you%20can%20use%20parenthesis%20in%20tags%20which%20show%20up%20in%20urls%20unencoded%20so%20uh.%20hmm%5Cn%5Cnedit%3A%20ooh%2C%20zero%20width%20spaces%20work.%20%5Cnoh%2C%20regular%20spaces%20also%20work%22%2C%22postingProject%22%3A%7B%22projectId%22%3A45605%2C%22handle%22%3A%22tit%22%2C%22displayName%22%3A%22softie%22%2C%22dek%22%3A%22tufted%20titmouse%20time%21%22%2C%22description%22%3A%22personal%20of%20@tuftedtitmouse%20%7C%20tufted%20titmouse%20obsessed%20%uD83D%uDD3C%20%7C%20pointy%20bird%20enjoyer%20%7C%202D/3D%20artist%20%7C%20industrial%20engineer%20%7C%20%28tits%20are%20a%20type%20of%20birds%20fyi%2C%20this%20proj%20is%20SFW%29%22%2C%22avatarURL%22%3A%22https%3A//staging.cohostcdn.org/avatar/45605-fcd23a03-5bb7-40c9-af7c-713da31afbca-profile.gif%22%2C%22avatarPreviewURL%22%3A%22https%3A//proxy-staging.cohostcdn.org/aiibFjq-z2neMVEeoJUYJRLMXVnyIij4WRMAyaPVIUk/f%3Apng/czM6Ly9yZWRjZW50LWRldi9hdmF0YXIvNDU2MDUtZmNkMjNhMDMtNWJiNy00MGM5LWFmN2MtNzEzZGEzMWFmYmNhLXByb2ZpbGUuZ2lm%22%2C%22headerURL%22%3A%22https%3A//staging.cohostcdn.org/header/45605-b31890fb-d5a4-4af8-a270-1d020a23af5a-profile.jpg%22%2C%22headerPreviewURL%22%3A%22https%3A//staging.cohostcdn.org/header/45605-b31890fb-d5a4-4af8-a270-1d020a23af5a-profile.jpg%22%2C%22privacy%22%3A%22public%22%2C%22url%22%3A%22http%3A//titmou.se/%22%2C%22pronouns%22%3A%22he/they%22%2C%22flags%22%3A%5B%5D%2C%22avatarShape%22%3A%22squircle%22%7D%2C%22shareTree%22%3A%5B%5D%2C%22numSharedComments%22%3A0%2C%22relatedProjects%22%3A%5B%5D%2C%22singlePostPageUrl%22%3A%22https%3A//cohost.org/tit/post/318138-a-little-bit-of-f%22%2C%22effectiveAdultContent%22%3Afalse%2C%22isEditor%22%3Afalse%2C%22hasAnyContributorMuted%22%3Afalse%2C%22contributorBlockIncomingOrOutgoing%22%3Afalse%2C%22postEditUrl%22%3A%22https%3A//cohost.org/tit/post/318138-a-little-bit-of-f/edit%22%2C%22isLiked%22%3Afalse%2C%22canShare%22%3Atrue%2C%22canPublish%22%3Atrue%7D

you can decode it in a JS console with unescape(JSON.parse('[string above]'))

login to reply

in reply to @tit's post: