So I noticed on a site I'm penetration testing that when you save your profile settings after changing them, one of the parameters in the POST request is avatar_url.
I realized that I could repeat the POST request and change this avatar_url to something like http://example.com/malicious.html and it put it in the code like this:
<span class="avatar-user user-avatar" data-name="e" style="background-image: url('http://example.com/malicious.html');"></span>
It does indeed change the URL to this in the code, but it doesn't actually display that for the image. It seems to have some filter against displaying it. For the avatar image, it'll just show the first letter of your username.
Is there a way that this behavior could be exploited for RCE or XSS or some kind of code execution? It seems like a bad idea to accept any URL including ones with malicious files for the avatar URL but I guess it isn't if it doesn't parse it.