`<base href="data:/,-alert(1)/">` works just fine in Chrome, which is strange indeed. If the discussion at https://github.com/whatwg/html/issues/2249 goes in a reasonable direction, we should change our behavior to match.
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/80883f862b84159e61a786edc04f5159afcb1267 commit 80883f862b84159e61a786edc04f5159afcb1267 Author: mkwst <mkwst@chromium.org> Date: Thu Jan 12 21:37:26 2017 Add some <base> metrics to guide experimentation. <base> has cropped up in some recent attacks, and maybe it's possible to tweak things a little bit to make it play better with the platform at large. Let's find out, shall we? BUG= 679318 Review-Url: https://codereview.chromium.org/2626243002 Cr-Commit-Position: refs/heads/master@{#443370} [modify] https://crrev.com/80883f862b84159e61a786edc04f5159afcb1267/third_party/WebKit/Source/core/dom/Document.cpp [modify] https://crrev.com/80883f862b84159e61a786edc04f5159afcb1267/third_party/WebKit/Source/core/frame/UseCounter.h [modify] https://crrev.com/80883f862b84159e61a786edc04f5159afcb1267/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp [modify] https://crrev.com/80883f862b84159e61a786edc04f5159afcb1267/tools/metrics/histograms/histograms.xml
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/60e243955ccc6ac466c074d812ae406dec337fe3 commit 60e243955ccc6ac466c074d812ae406dec337fe3 Author: mkwst <mkwst@chromium.org> Date: Thu Feb 09 11:57:01 2017 'data:' may not be used as a document's base URL. Intent: https://groups.google.com/a/chromium.org/d/msg/blink-dev/TsBB5GOpMZA/AAE_Sb_HBwAJ Spec: https://github.com/whatwg/html/issues/2249 BUG= 679318 Review-Url: https://codereview.chromium.org/2685843003 Cr-Commit-Position: refs/heads/master@{#449262} [modify] https://crrev.com/60e243955ccc6ac466c074d812ae406dec337fe3/third_party/WebKit/LayoutTests/external/wpt/MANIFEST.json [add] https://crrev.com/60e243955ccc6ac466c074d812ae406dec337fe3/third_party/WebKit/LayoutTests/external/wpt/html/semantics/document-metadata/the-base-element/base_href_data.html [modify] https://crrev.com/60e243955ccc6ac466c074d812ae406dec337fe3/third_party/WebKit/LayoutTests/fast/url/relative-expected.txt [modify] https://crrev.com/60e243955ccc6ac466c074d812ae406dec337fe3/third_party/WebKit/LayoutTests/fast/url/script-tests/relative.js [delete] https://crrev.com/eb73e4330ecb59905157b11ce20ca29345d9635e/third_party/WebKit/LayoutTests/fast/url/script-tests/segments-from-data-url.js [delete] https://crrev.com/eb73e4330ecb59905157b11ce20ca29345d9635e/third_party/WebKit/LayoutTests/fast/url/segments-from-data-url.html [modify] https://crrev.com/60e243955ccc6ac466c074d812ae406dec337fe3/third_party/WebKit/Source/core/dom/Document.cpp [modify] https://crrev.com/60e243955ccc6ac466c074d812ae406dec337fe3/third_party/WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp
Issue 689412 has been merged into this issue.
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c133efa0b915430701930b76a7cfe35608b9a403 commit c133efa0b915430701930b76a7cfe35608b9a403 Author: Mike West <mkwst@chromium.org> Date: Fri Jan 05 16:14:38 2018 'javascript:' may not be used as a document's base URL. Bug: 679318 , 796215 Change-Id: I8513e7f7efaba0994eeefce83887855a4dbf107a Reviewed-on: https://chromium-review.googlesource.com/836387 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Mike West <mkwst@chromium.org> Cr-Commit-Position: refs/heads/master@{#527288} [add] https://crrev.com/c133efa0b915430701930b76a7cfe35608b9a403/third_party/WebKit/LayoutTests/http/tests/security/base-url-data-expected.txt [add] https://crrev.com/c133efa0b915430701930b76a7cfe35608b9a403/third_party/WebKit/LayoutTests/http/tests/security/base-url-data.html [add] https://crrev.com/c133efa0b915430701930b76a7cfe35608b9a403/third_party/WebKit/LayoutTests/http/tests/security/base-url-javascript-expected.txt [add] https://crrev.com/c133efa0b915430701930b76a7cfe35608b9a403/third_party/WebKit/LayoutTests/http/tests/security/base-url-javascript.html [modify] https://crrev.com/c133efa0b915430701930b76a7cfe35608b9a403/third_party/WebKit/Source/core/dom/Document.cpp
Comment 1 by mkwst@chromium.org
, Jan 12 2017