Q:

How can a tag badge for  be tracked?

While viewing a user's profile, I found that the next tag badge being tracked is the bronze  badge. There is not even a  badge, and I don't understand how or why this is possible.

So, uhh, what's the deal with this? Is it intentional behavior?

A:

This answer provides the method of how this used to be achieved and how it used to work. Sadly, this has been fixed now. See Jeremy’s answer.

Click on the tag tracker:

Open the browser console (dev tools) (hit F12), and inspect one of the options:

Look for the <div> that has a data-badge-database-name attribute, then double-click to edit its value:

Change it to , or whatever you like, then hit Enter to save the value:

Then simply click on the option you’ve manipulated:

You’re now tracking a non-existent tag badge:

Under the hood, a POST request is sent to the server at step 5. The POST request takes the value from the data-badge-database-name attribute verbatim. The request is POST https://stackoverflow.com/users/activity/next-badge-popup/save with this body:
fkey=(long hex code)
badgeDatabaseName=
isTagBadge=true

I’ve also tried to manipulate the POST request directly but had no success in changing the tracked badge.

A:

Sebastian Simon’s answer describes how I was doing this. Tragically, the attention this has drawn to the bug has caused it to be fixed: trying to set a nonexistent tag now results in an error. 

Non-existent tag names that were previously set have been left unmodified (for now). The system still allows you to track a tag that has not reached the 100-question threshold to have a real tag badge.

There was no XSS or SQLi risk here. It was just ... let's go with "unwanted". I haven't sought an official policy decision on the pre-existing data, and it doesn't seem to present any immediate concerns, so for now I've just left them as-is. I don't guarantee that they won't be removed in the future. – Marc Gravell♦ 6 hours ago

