Presumably people will start running having all sorts of fun fuzzing Google Docs now that they know that it’s not an infallible, opaque product…
Any web app pentesters here willing throw in their 2c? Could this offer insights into the way data is parsed in the backend, or might result in something more interesting than a crash?
I find it very poetic that this crash was triggered by a poem, here's the poem:
> Duration and the body: I thought about something I had read a while ago which said that a body, the body, is defined by duration. That a body in the present is inseparable from its previous state, that a body is linked in a continuous strand… and so on and so on… I thought about my body. It’s past. It’s present… Which made me think about the word and. And. And. And. And. And. Then.
> Now. Now. Now. Now. Now, I felt in the present like I was living always alongside a previous body. This is why I had expected to find myself in the apartment when I returned home from California.
Took me right back one of many detentions I served at school, when Mr B Swales set us the challenge of finding a grammatically correct English sentence with five ands in a row.
The answer was as follows:
The landlord of the "Dog and Partridge" pub commissioned a signwriter to letter a new board outside. On looking at the work, the landlord declared that he liked the colour but would prefer more spacing between Dog and and, and and and Partridge.
Wouldn’t the sentence ‘I want to put a hyphen between the words Fish and And and And and Chips in my Fish-And-Chips sign’ have been clearer if quotation marks had been placed before Fish, and between Fish and and, and and and And, and And and and, and and and And, and And and and, and and and Chips, as well as after Chips?
Discovered by Eliza Callahan triggered by a poem in the middle of her novel. (Friend of a coworker)
That poem can be found here: https://durationandthebodyelizacallahan.cargo.site/ - if viewing on mobile you have to Request Desktop Site for some reason, at least on Android it initially shows up as a Lorem Ipsum page
As arguments for the thesis that the tech world needs to embrace the humanities go, an author discovering a bug in a google product by writing a poem is pretty good, if maybe a bit too on the nose.
I know you didn't write that poem, but I'm 99% certain the apostrophes in "I thought about my body. It's past. It's present." have no business being there :)
Here's a bug I discovered in MS Word in 2004, which has survived the past 18 years of updates and is even present in the web version: https://1drv.ms/w/s!AgYiBqBjIZZpfkcvO9jnOel9T2o?e=tFA4wp If you join the two lines using a backspace at the start of the second line, the second line turns into gibberish.
The first line ("paragraph") has its style set to "BodyText3", but also has formatting on that section of text itself, overriding it. Once the lines are joined into one paragraph, the paragraph formatting appears in the second part because that text does not have a style to override it.
How did you create the document? When I hit backspace it does "turn into gibberish", but because it seems to inherit the type choices from the ether between the two lines to put it into Wingdings in red with italic and strikethrough. Did you create that type setting?
I've heard people say it, speaking like this: "This would be a great solution to the problem, except that it would break the admin dashboard. And billing. And SSO. And partner test environments. And. And. And. And. And. This would break so many things I'm sure I could only name half of them if I tried."
Years ago in school, maybe about 1992 or so, I managed to make xdm (X Display Manager) crash and dump me a root window by simply holding down a key until the buffer ran out. I remember wondering how anybody didn't discover this before me. Similar behavior with the university phone system (repeatedly pressing '0') eventually dropped me an outside line that I didn't have to pay for (yes, for you young folks, we used to have to pay for long distance phone calls, on phones that didn't fit in our pockets).
Once a customer was able to destroy an old ES cluster because they copy pasted some text from a PDF into a search box ... that text got sent directly to the ES cluster without much escaping ... there were lots of "*" in there.
The query complexity exploded, ES ran out of memory, and the index got corrupted and I don't remember why, it could not recover.
We had to re-index all the data. Lots of fun.
Lesson learned: prepare for the impossible, keep your infrastructure up to date, escape queries :)
Maybe escaping the character wouldn't help if every * is telling the server to process a long loop, but some max range or time to perform the task. I can't tell which company, but I managed to do exactly that you described a few months ago, with a valid query, and it's one of those companies you can guess if I tell you the first letter of its name.
Yup seen that in a few online "stores" or companies where they use SOLR or ES. Putting in '' will make boxes explode* (ok not really).
What is twice is bad as that the worst of these, fail (at least to my eye) on two fronts.
1) Allowing SINGLE character searches. I.e No min query-length.
2) Not escaping querying - lucene(solr/es) syntax.
You can sometimes see the front-facing "html/js/api" is just a thin layer over ES/SOLR.(Which is not bad by itself) it's when you don't know the limitations or what sort of queries are x100 harder to do than orders.
> Google Docs uses a "Markov Chain" to predict the next word for autocompletion purposes. In this case, of course, since we've already written "And" 5 times, the only logical next word would be "And", as showed in Djikstra's 1989 paper on the subject. Therefore, the Markov Chain never terminates and hence the memory chain overflows with infinite ands.
Does anyone know why this bug doesn’t repro for some words other than And if this is the case?
> Obviously, this is partly intentional- Gregory Markov modelled his famous Chain after his younger brother, who would try to finish all of Gregory's sentences for him. The one way Markov could fool him would be to repeat the same word multiple times, and then say "Jinx", also I made all of this up, good luck Google Docs team
I'm not sure that comment is true based on the second paragraph of it:
> Obviously, this is partly intentional- Gregory Markov modelled his famous Chain after his younger brother, who would try to finish all of Gregory's sentences for him. The one way Markov could fool him would be to repeat the same word multiple times, and then say "Jinx", also I made all of this up, good luck Google Docs team
– I bet you a beer you can't make a logical, grammatical sentence with five ands in a row
– I used to be a sign writer in a previous life and one of the jobs I had was to repaint the sign hanging over the door to this very pub. Except the publican was adamant that he wanted more space between the words. Where exactly I asked? In between the Pig and and, and and and Whistle he replied.
Google Docs crashes in Firefox on Windows 10 with your link.
When I re-create the document from scratch, it does not crash.
When I copy the link to my non-crashing document and load it in a new tab, the crash then occurs when I edit the document in the new tab but not when I edit it in the original tab.
It's interesting seeing how many people interact with that link. +40 users in a matter of minutes, and some instant spam suggestions too. Kind of funny.
Sort of related, last night I managed to make Clang crash by feeding it a certain C++ program: https://i.imgur.com/r5MC2aK.png
It was very surprising that there was a way to get Clang to segfault. Should I report it somewhere?
The code is basically doing a recursive template expansion with some C++20 concept constraints. So it's not quite as simple as "And. And...", but it's similar in that certain input text causes a crash. I just have no idea whether to report it, or where.
Clang segfaulting is somewhat common. It usually doesn't happen, but sometimes when I write some cursed template metaprogramming code it crashes and I'm not surprised. In your case, especially because you are using C++20 concepts, that is a newer feature and you probably hit some less-tested codepath.
Note that it might be worth trying the latest clang version first. The latest proper version is 14.0.0 from Mar 25, which is only a month old compared to the 7 months of 13.0.0, but if it's something that's condensable to a single file, you could test it on https://godbolt.org/z/hv41441jK, which has daily builds.
Hypothesis from chatting about this with people nearby - somehow this string makes the grammar engine search space too large (that's the AI that predicts your next words) and it's running out of memory.
Perfect prank document to send to the team. I'm just hoping it holds up until the morning so everyone can join the fun and not just those of us with bad work time habits.
Only tangentially related, and not at all serious, but this reminded me of the Irish film "The Committments" (1991) in which a working class Dublin guy puts together a soul band. He's introduced to two promising musicians who are already in a band...
Jimmy: What do you call yourselves?
Derek: "And And And."
Jimmy: "And And fuckin' And?"
Derek : Well, Ray's thinking of putting an exclamation mark after the second "and." Says it'd look deadly on the posters.
Jimm: Psshh...
Outspan: You don't like it? You think it should go at the end?
I've had emails crash gmail on my phone still to this day. Typically it's stuff like output logs. My guess is something to do with the repetitive lines, but who knows.
> Dear Google Docs users, we are aware of the issue and working on a fix right now. Thank for surfacing this issue and sharing it with us. We will keep you posted!
I can't get the bug to reproduce. But maybe someone else could try
Wouldn't the sentence 'I want to put a hyphen between the words Fish and And and And and Chips in my Fish-And-Chips sign' have been clearer if quotation marks had been placed before Fish, and between Fish and and, and and and And, and And and and, and and and And, and And and and, and and and Chips, as well as after Chips?
“And And! And.” was Outspan Foster’s band before joining “The Commitments”[0] and later The Frames (as Glen Hansard). The screenplay was written before gDocs.
I remember discovering that pasting a specific emoji to Google Slides causes the slide to become "poison". You could not view or edit it, the web UI would crash if you clicked on the slide. I discovered this by accident, but did not think much of it as I was able to work around by deleting the slide from the document overview.
I wonder if "James where John had had had had had had had had had had had a better effect on his teacher" does someone's grammar checker up in knots. Or any of the old standbys, like "Police police police police police police".
omg I tried to post a reply on that support page and it errored out saying "you need to be signed in ..." while I could literally see my sign in logo top right corner of the page.
fking google.
there are good [as well as technical humurous] comments on the page.
An odd coincidence, I recall that pressing an operator button on an older HP calculator would also cause an error, because the stack was 4 levels deep.
I’m willing to bet it’s related to this. Google docs is trying to guess something for autocomplete, similar to their gmail feature to complete your sentences.
Which means, on a privacy standpoint, whatever you’re writing and guessing, they are absolutely processing something.
We the user are the product, apparently. This is mildly creepy to me because, I do vent on google docs sometimes. And assume only I can read it..
It’s literally called a word processors, so I suppose it processes the words. I don’t have a problem with that, as long as my data is only used for purposes I have approved and to provide features I use.
Some comments were deferred for faster rendering.
kklisura|3 years ago
Has something to do with grammar. The document does not fail when `Show grammar suggestion` is turned off.
croddin|3 years ago
Each in caps 5 times with the same word with a period and space after each word and newline at the end is what I have found so far.
Can anyone find others?
Edit: added words that work found in other comments, and found more.
deltarholamda|3 years ago
I did not expect them to weaponize it, but Skynet does as Skynet does.
Alex3917|3 years ago
lqet|3 years ago
greggsy|3 years ago
Any web app pentesters here willing throw in their 2c? Could this offer insights into the way data is parsed in the backend, or might result in something more interesting than a crash?
jonnycomputer|3 years ago
a-dub|3 years ago
would be funny if it were a remotely exploitable bug in an api endpoint.
tus666|3 years ago
the_snooze|3 years ago
sharmavinu0024|3 years ago
unknown|3 years ago
[deleted]
AccountAccount1|3 years ago
> Duration and the body: I thought about something I had read a while ago which said that a body, the body, is defined by duration. That a body in the present is inseparable from its previous state, that a body is linked in a continuous strand… and so on and so on… I thought about my body. It’s past. It’s present… Which made me think about the word and. And. And. And. And. And. Then.
> Now. Now. Now. Now. Now, I felt in the present like I was living always alongside a previous body. This is why I had expected to find myself in the apartment when I returned home from California.
https://durationandthebodyelizacallahan.cargo.site/
quakeguy|3 years ago
unknown|3 years ago
[deleted]
AlexMuir|3 years ago
The answer was as follows:
The landlord of the "Dog and Partridge" pub commissioned a signwriter to letter a new board outside. On looking at the work, the landlord declared that he liked the colour but would prefer more spacing between Dog and and, and and and Partridge.
justinpombrio|3 years ago
Wouldn’t the sentence ‘I want to put a hyphen between the words Fish and And and And and Chips in my Fish-And-Chips sign’ have been clearer if quotation marks had been placed before Fish, and between Fish and and, and and and And, and And and and, and and and And, and And and and, and and and Chips, as well as after Chips?
chatmasta|3 years ago
Moru|3 years ago
"Far, får får får?"
"Nej, får får inte får, får får lamm."
English would be:
"Father, does sheep get sheep?"
"No, sheep does not get sheep, sheep gets lambs."
No, google translate does not make it unscathed through that sentence :-)
IIAOPSW|3 years ago
busterroni|3 years ago
https://en.wikipedia.org/wiki/Buffalo_buffalo_Buffalo_buffal...
paconbork|3 years ago
Affric|3 years ago
So, the the trick is using it as a conjunction and a noun.
atxbcp|3 years ago
coreyp_1|3 years ago
elliekelly|3 years ago
nicooo|3 years ago
onionisafruit|3 years ago
unknown|3 years ago
[deleted]
patneedham|3 years ago
roughly|3 years ago
_rf|3 years ago
pvillano|3 years ago
raldi|3 years ago
oblosys|3 years ago
Jap2-0|3 years ago
If you look at the XML (change .docx to .zip) in styles.xml you see the declaration of the style "BodyText3":
The first line ("paragraph") has its style set to "BodyText3", but also has formatting on that section of text itself, overriding it. Once the lines are joined into one paragraph, the paragraph formatting appears in the second part because that text does not have a style to override it.kingcharles|3 years ago
MauranKilom|3 years ago
blueberrychpstx|3 years ago
Let's place bets:
A) The user just let autocomplete "take it away" (not sure about this one since they were able to access the console)
B) Pen Testing?
C) Error copy and pasting?
D) Actual dialog in a sci-fi post-apocalyptic love story where a robot discovers the Turing test and attempts to set itself into an infinite loop.
dkarl|3 years ago
technothrasher|3 years ago
matthberg|3 years ago
That comment is from the submitter of the issue (and HN post), the poem is from Eliza Callahan (copy found here): https://durationandthebodyelizacallahan.cargo.site
The relevant excerpt: "I thought about my body. It’s past. It’s present… Which made me think about the word and. And. And. And. And. And. Then."
avgcorrection|3 years ago
orblivion|3 years ago
a-dub|3 years ago
personally, i've happened across some pretty serious security bugs this way.
t_mann|3 years ago
fnord123|3 years ago
glitchc|3 years ago
unknown|3 years ago
[deleted]
amelius|3 years ago
OhSoHumble|3 years ago
quickthrower2|3 years ago
Patrol8394|3 years ago
The query complexity exploded, ES ran out of memory, and the index got corrupted and I don't remember why, it could not recover.
We had to re-index all the data. Lots of fun.
Lesson learned: prepare for the impossible, keep your infrastructure up to date, escape queries :)
ffhhj|3 years ago
rawoke083600|3 years ago
What is twice is bad as that the worst of these, fail (at least to my eye) on two fronts.
1) Allowing SINGLE character searches. I.e No min query-length.
2) Not escaping querying - lucene(solr/es) syntax.
You can sometimes see the front-facing "html/js/api" is just a thin layer over ES/SOLR.(Which is not bad by itself) it's when you don't know the limitations or what sort of queries are x100 harder to do than orders.
thekiptxt|3 years ago
Does anyone know why this bug doesn’t repro for some words other than And if this is the case?
ghayes|3 years ago
> Obviously, this is partly intentional- Gregory Markov modelled his famous Chain after his younger brother, who would try to finish all of Gregory's sentences for him. The one way Markov could fool him would be to repeat the same word multiple times, and then say "Jinx", also I made all of this up, good luck Google Docs team
timando|3 years ago
sailingparrot|3 years ago
Sohcahtoa82|3 years ago
> Obviously, this is partly intentional- Gregory Markov modelled his famous Chain after his younger brother, who would try to finish all of Gregory's sentences for him. The one way Markov could fool him would be to repeat the same word multiple times, and then say "Jinx", also I made all of this up, good luck Google Docs team
noduerme|3 years ago
akersten|3 years ago
unknown|3 years ago
[deleted]
ayashko|3 years ago
– I bet you a beer you can't make a logical, grammatical sentence with five ands in a row
– I used to be a sign writer in a previous life and one of the jobs I had was to repaint the sign hanging over the door to this very pub. Except the publican was adamant that he wanted more space between the words. Where exactly I asked? In between the Pig and and, and and and Whistle he replied.
interestica|3 years ago
https://en.wikipedia.org/wiki/Garden-path_sentence
aliljet|3 years ago
MiddleEndian|3 years ago
When I re-create the document from scratch, it does not crash.
When I copy the link to my non-crashing document and load it in a new tab, the crash then occurs when I edit the document in the new tab but not when I edit it in the original tab.
sillysaurusx|3 years ago
Thank you for the repro case!
aliljet|3 years ago
unknown|3 years ago
[deleted]
sillysaurusx|3 years ago
It was very surprising that there was a way to get Clang to segfault. Should I report it somewhere?
The code is basically doing a recursive template expansion with some C++20 concept constraints. So it's not quite as simple as "And. And...", but it's similar in that certain input text causes a crash. I just have no idea whether to report it, or where.
mtoner23|3 years ago
tylerhou|3 years ago
dzaima|3 years ago
nopakos|3 years ago
mshockwave|3 years ago
Please do. You can open an issue (Bugzilla has been deprecated) on LLVM's github repo: https://github.com/llvm/llvm-project
hoten|3 years ago
loxias|3 years ago
below43|3 years ago
apanloco|3 years ago
cybertoad|3 years ago
magneticnorth|3 years ago
Hypothesis from chatting about this with people nearby - somehow this string makes the grammar engine search space too large (that's the AI that predicts your next words) and it's running out of memory.
truly|3 years ago
unknown|3 years ago
[deleted]
Ansil849|3 years ago
[1] https://www.pcmag.com/news/google-drive-flags-text-files-con...
I don't recall that the reason for that bug was ever explained. I wonder if the reason for this one will be.
queuebert|3 years ago
peterburkimsher|3 years ago
Probably because it's out of paper.
Related: how is paper fed into an Apple Magic Keyboard - Hebrew?
Edit: Tried to reproduced with Arabic keyboard, plugged in now. Accidentally inverted right-to-left in brain.
dnA. dnA. dnA. dnA. dnA.
jrd79|3 years ago
vldx|3 years ago
jonnycomputer|3 years ago
So, more seriously, what might cause this (mis)behavior?
unknown|3 years ago
[deleted]
Sohcahtoa82|3 years ago
EDIT: Ah, I had to reload the page, thank you child comments.
lopatin|3 years ago
mshockwave|3 years ago
daniel_iversen|3 years ago
valenaut|3 years ago
"And. And. And. And." caused no problems.
"And. And. And. And. And. And." also crashes (5 "And."s is a substring, so makes sense).
I cannot imagine how this bug is occurring.
pmichaud|3 years ago
unknown|3 years ago
[deleted]
Normal_gaussian|3 years ago
mikotodomo|3 years ago
seangrogg|3 years ago
That was the part that led to the apocalypse.
This was not a coincidence, because nothing is ever a coincidence.
unknown|3 years ago
[deleted]
croddin|3 years ago
metalliqaz|3 years ago
Also. Also. Also. Also. Also.
raffraffraff|3 years ago
Jimmy: What do you call yourselves?
Derek: "And And And."
Jimmy: "And And fuckin' And?"
Derek : Well, Ray's thinking of putting an exclamation mark after the second "and." Says it'd look deadly on the posters.
Jimm: Psshh...
Outspan: You don't like it? You think it should go at the end?
Jimmy: I think it should go up his arse.
Outspan: Well, we're not married to it.
unknown|3 years ago
[deleted]
throw7|3 years ago
herpderperator|3 years ago
> Dear Google Docs users, we are aware of the issue and working on a fix right now. Thank for surfacing this issue and sharing it with us. We will keep you posted!
> Deving
> Google Employee
petters|3 years ago
The task was to "determine the cross ratio between sea and and and and and land".
calebegg|3 years ago
ronald_raygun|3 years ago
Wouldn't the sentence 'I want to put a hyphen between the words Fish and And and And and Chips in my Fish-And-Chips sign' have been clearer if quotation marks had been placed before Fish, and between Fish and and, and and and And, and And and and, and and and And, and And and and, and and and Chips, as well as after Chips?
mike_d|3 years ago
smcnally|3 years ago
[0] https://www.imdb.com/title/tt0101605/quotes/qt0310982
vesinisa|3 years ago
unknown|3 years ago
[deleted]
westonjackson|3 years ago
bitwize|3 years ago
queuebert|3 years ago
rikeanimer|3 years ago
fking google.
there are good [as well as technical humurous] comments on the page.
croddin|3 years ago
unknown|3 years ago
[deleted]
LordDragonfang|3 years ago
Doesn't appear to be an issue for the android app, but that might be a cache thing.
dreamcompiler|3 years ago
https://www.youtube.com/watch?v=4WRtqmHpLvg
nofunsir|3 years ago
Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo. (2)
[1] https://en.wikipedia.org/wiki/James_while_John_had_had_had_h...
[2] https://en.wikipedia.org/wiki/Buffalo_buffalo_Buffalo_buffal...
blatherard|3 years ago
> May 6, 2022 Update: We have fixed an issue in Docs related to repetitive use of the word ‘and.’ This fix should soon be in place for all customers.
glouwbug|3 years ago
JoeAltmaier|3 years ago
However. However. However. However. However.
Why. Why. Why. Why. Why.
js8|3 years ago
analog31|3 years ago
rossdavidh|3 years ago
strictfp|3 years ago
wardedVibe|3 years ago
X6S1x6Okd1st|3 years ago
oliwary|3 years ago
pinewurst|3 years ago
selimthegrim|3 years ago
pipeline_peak|3 years ago
unknown|3 years ago
[deleted]
tmalsburg2|3 years ago
iagocds|3 years ago
graderjs|3 years ago
unknown|3 years ago
[deleted]
srinathkrishna|3 years ago
edgyquant|3 years ago
endisneigh|3 years ago
kabes|3 years ago
Nitramp|3 years ago
likortera|3 years ago
ineedasername|3 years ago
ricardobayes|3 years ago
fortran77|3 years ago
yashg|3 years ago
bufferoverflow|3 years ago
goody71|3 years ago
mintplant|3 years ago
nograpes|3 years ago
rdudek|3 years ago
mc4ndr3|3 years ago
mxuribe|3 years ago
draxil|3 years ago
unknown|3 years ago
[deleted]
eek2121|3 years ago
dr_dshiv|3 years ago
schmeckleberg|3 years ago
iamyatin|3 years ago
shreyansh26|3 years ago
tnli|3 years ago
dropit_sphere|3 years ago
captaincaveman|3 years ago
8bitben|3 years ago
soperj|3 years ago
okaydeveloper|3 years ago
kodeninja|3 years ago
piemadd|3 years ago
skerit|3 years ago
twism|3 years ago
whoevercares|3 years ago
wardedVibe|3 years ago
mark_prutskyi|3 years ago
fedeb95|3 years ago
zciwor|3 years ago
_wldu|3 years ago
Edit: You guys have no sense of humor.
ffhhj|3 years ago
elektrons|3 years ago
glitchc|3 years ago
mattrighetti|3 years ago
fdgsdfogijq|3 years ago
munk-a|3 years ago
dang|3 years ago
JasonFruit|3 years ago
[deleted]
mtgx|3 years ago
[deleted]
bspear|3 years ago
sharmavinu0024|3 years ago
fareesh|3 years ago
sam1r|3 years ago
Which means, on a privacy standpoint, whatever you’re writing and guessing, they are absolutely processing something.
We the user are the product, apparently. This is mildly creepy to me because, I do vent on google docs sometimes. And assume only I can read it..
simonh|3 years ago