There's actually no proof or claim of XSS vulnerability in this bizarre article. Username url confused with special url is a common bug, I've seen it "exploited" on facebook.
The exploit I read in the vice.com article is the attackers username or a post could contain "" and be unescaped and automatically sign users that loaded that page out. If you don't want to call that an XSS, what would you like to call that?
The claim regarding username is 'i can make my username "signout" and it signs people out when they click my profile', not that it can contain , so no html injection here.
Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0]
Posts could contain a safe subset of html (no scripting) including as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality.
>If you don't want to call that an XSS, what would you like to call that?
I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended.
> OWASP considers the term cross-site scripting to be a misnomer. It initially was an attack that was used for breaching data across sites, but gradually started to include other forms of data injection attacks.[2]
They were referring to the comment they were replying to, which claimed that the original code was written (by humans) as poorly as AI does today. But AI today wouldn't write bugs that basic.
