How exactly did the recent TweetDeck vulnerability work? It says here that it had something to do with the HTML heart character but I don't fully understand what the explanation means. From the link:
" I was tweeting about the HTML-heart-symbol (♥), because I didn't know that this is possible," He told The Register in response to questions via email.
TweetDeck is not supposed to display this as an image. Because it's simple text, which should be escaped to '♥'. But in my tweet I used the Unicode-character of the heart as a reference for my followers.
There were two hearts. One was black (at the position where the ♥ was supposed to be) and one was red (this one was the Unicode-char and got replaced by TweetDeck).
So, I started to play around, and discovered, that the Unicode-Heart (which gets replaced with an image by TweetDeck) somehow prevents the tweet from being HTML-escaped. So I used a strong-HTML-tag to verify this ... It worked.
So I wrote a little script which displays a popup and then blocks itself. It worked."
What exactly was the attack vector here? And how did it "somehow prevent the tweet from being HTML-escaped"?