# Stored XXS @ https://steamcommunity.com/search/users/#text= via Profile Name

Stored XSS in Steam Community user search: a profile name containing `');alert(...)//` breaks out of the inline onclick AddFriend() call and fires when a victim clicks 'Add as friend'.

- Payout: $750
- Severity: medium
- Program: Valve
- Credited: osintopsec
- Disclosed: 2018-05-24
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/351171
- Library page: https://bugbountylibrary.com/r/h1%3A351171
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:medium technique:source-review vuln:xss

**Target:** steamcommunity.com user search endpoint / profile name field
**Root cause:** Profile name is interpolated unescaped into an inline `onclick="AddFriend(false,'PROFILE_NUMBER','NAME')"` handler; single quotes, semicolons and parens are not encoded, so a name can close the string and inject JS.
**Steps:**
1. Log in as attacker, edit profile name to `__NAME'); alert(document.cookie+'__`
2. As victim in another session, go to `https://steamcommunity.com/search/users/#text=`
3. Search for the attacker's profile name
4. Click the `ADD AS FRIEND` button next to the result
5. Payload executes in steamcommunity.com origin
**How found:** Noticed the AddFriend() call is built by string-concatenating the profile name into an inline onclick handler, and that the name field allows quote/semicolon/paren characters, enabling string escape.
**Exploitation:** Attacker sets a crafted profile name; victim searches for it and clicks the Add-as-friend button, executing attacker JS in the victim's session context (cookie theft/session abuse). Requires victim interaction and fits within the 32-char profile name limit.
**Insight:** When a value is embedded in an inline JS handler inside a quoted string, test whether the field permits `'`, `;`, `(`, `)` — even a 32-char limit is enough for a short breakout payload like `');alert(1)//`.