New issue
Advanced search Search tips

Issue 590874 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Feb 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

XSSAuditor does not filter the area token. However, area.href does support JS URIs

Project Member Reported by slekies@google.com, Feb 29 2016

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.97 Safari/537.36

Steps to reproduce the problem:
1. Open this link: http://iq-firingrange.appspot.com/reflected/parameter/body?q=%3Cmap%20name=%22abcdef%22%3E%3Carea%20href=%22javascript:alert(1)%22%20shape=%22rect%22%20coords=%220,0,500,500%22%3E%3C/map%3E%3Cimg%20width=500%20height=500%20%20src=%22data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==%22%20usemap=%22%23abcdef%22%3E
2. Click the image
3. alert pops up

What is the expected behavior?
The area.href attribute gets removed by the XSSAuditor

What went wrong?
The XSSAuditor is not filtering area tags

Did this work before? N/A 

Chrome version: 48.0.2564.97  Channel: n/a
OS Version: 
Flash Version: Shockwave Flash 20.0 r0
 

Comment 1 by tsepez@chromium.org, Feb 29 2016

Owner: tsepez@chromium.org
Status: Assigned (was: Unconfirmed)

Comment 2 by tsepez@chromium.org, Feb 29 2016

Just for posterity, the reflection is:

<html>
  <body>
    <map name="abcdef"><area href="javascript:alert(1)" shape="rect" coords="0,0,500,500"></map><img width=500 height=500  src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==" usemap="#abcdef">
  </body>
</html>

Comment 3 by och...@chromium.org, Feb 29 2016

Components: Blink>SecurityFeature
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug

Comment 4 by tsepez@chromium.org, Feb 29 2016

Status: WontFix (was: Assigned)
Your server is sending an X-XSS-Protect: 0 header. XSSAuditor catches this in my test environent.  Thanks.

Comment 5 by slekies@google.com, Feb 29 2016

OMG, how did I miss that. Sorry for wasting your time.

Sign in to add a comment