XSS Auditor overly aggressive; blocks e.g. google search for "href='javascript:void()"
Reported by
martin.t...@viison.com,
Jun 3 2016
|
||||||
Issue descriptionChrome Version : 48.0.2564.116 URLs (if applicable) : https://www.google.com/search?q=href%3d%22javascript%3avoid() Other browsers tested: Firefox: OK What steps will reproduce the problem? (1) Open https://www.google.com/search?q=href%3d%22javascript%3avoid() What is the expected result? Chrome displays the website What happens instead? The XSS Auditor recognizes that the search string is similar to the attribute of an '<a>' anchor element (<a href="javascript:void(0)" data-bucket="websearch" ...>) within the requested website and blocks the requested website from being loaded and displayed. Opening https://www.google.com/search?q=href%3d%22javascript%3avoid(1) instead works as expected. Opening https://www.google.com/search?q=href%3d%27javascript%3avoid() instead works as expected. This can't be the expected behavior of the XSS Auditor. Please provide any additional information below. Attach a screenshot if possible. Developer console log: Navigated to https://www.google.de/search?q=href%3D%22javascript:void()&gws_rd=cr&ei=-N1RV8rMDIWOU_7_tFg search?q=href%3D"javascript:void()&gws_rd=cr&ei=-N1RV8rMDIWOU_7_tFg:54 The XSS Auditor blocked access to 'https://www.google.de/search?q=href%3D%22javascript:void()&gws_rd=cr&ei=-N1RV8rMDIWOU_7_tFg' because the source code of a script was found within the request. The server sent an 'X-XSS-Protection' header requesting this behavior.
,
Jun 9 2016
Able to reproduce the issue on Windows 7, Mac 10.11.5, Ubuntu 14.04 using 48.0.2564.116, latest stable 51.0.2704.84, canary 53.0.2762.0 with below steps: 1.Opened URL: https://www.google.com/search?q=href%3d%22javascript%3avoid() 2.Observed that the website is not displayed and blank page opened. This is non regression issue seen from M-30(30.0.1549.0).Hence, marking it as untriaged. Could anyone from dev team look into this issue please.
,
Jun 9 2016
,
Jul 7 2016
Moving this nonessential bug to the next milestone. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Feb 23 2017
Tom, opinions?
,
Feb 24 2017
Such is life. About the only option would be to filter rather than block by default if this becomes a big deal. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by martin.t...@viison.com
, Jun 3 2016