New issue
Advanced search Search tips

Issue 611763 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: May 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug



Sign in to add a comment

Editing field values in Developer Tools can lead to script execution

Reported by baiju.d...@gmail.com, May 13 2016

Issue description

1.on google chrome log into a website which has editable field.for example:https://scholar.google.com/
2.go to inspect element for any of the field from profile
3.change the field value to  "><img src=x onerror=prompt('0');>
4.XSS pop up is fired

This happens in any website with editable field.

checked the same with all the other browsers.This does not happen in mozilla,IE.
also this does not happen with other Payloads like ><img src=x onerror=prompt('0');>
 
xss.png
198 KB View Download
Components: Platform>DevTools>HTML
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug
Summary: Editing field values in Developer Tools can lead to script execution (was: Security: XSS when a field is edited with particular payload)
Using the Developer tools to execute code does not represent a security vulnerability.

Whether the developer tools ought to sanitize user input is a question for that team.

Comment 2 Deleted

Comment 3 by caseq@chromium.org, May 14 2016

Can't reproduce this so far -- do you have any extensions installed? Any DevTools extensions, perhaps?

Comment 4 by caseq@chromium.org, May 14 2016

Labels: Needs-Feedback
No,I am not using any extensions in developer tools.

Here is POC:http://screencast.com/t/YpmTycp2MLj
Project Member

Comment 6 by sheriffbot@chromium.org, May 14 2016

Labels: -Needs-Feedback Needs-Review
Owner: caseq@chromium.org
Thank you for providing more feedback. Adding requester "caseq@chromium.org" for another review and adding "Needs-Review" label for tracking.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
any updates?

Comment 8 by caseq@chromium.org, May 16 2016

Status: WontFix (was: Unconfirmed)
Well, this is not XSS. Call it self-XSS if you like, but having the code run in the page as a result of user action is DevTools' functionality by design. There's definitely more than one way to do it.

Sign in to add a comment