Thanks for your report.  You're right that this was a deliberate design decision to reduce false positives:

https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/html/parser/XSSAuditor.cpp?rcl=50549d69c7c12eb9058011dac35c6b7f351f51a1&l=916

I think we may need to start collecting statistics about this.  Mike?

Per our vulnerability guidelines, XSS Auditor bypasses are not security bugs.

We can add a use-counter pretty easily. *shrug* Might as well do so.

Is this somehow different than Issue 392964?

Issue 392964 has the prerequisite "if a website lets you upload arbitrary text files". I reported a problem that doesn't require arbitrary uploads. It requires that there is JavaScript under the webroot that manipulates the DOM (controllable by the attacker) in an unsafe way. Example in pseudoish code:

  // example.js
  somediv.innerHTML=somelink.getAttribute('data-title');

If there's an XSS somewhere on the site, the attacker can inject something like:

  <div id="somediv"></div>
  <a id="somelink" data-title="&lt;svg onload=alert('xss'); /&gt; "></a>
  <script src="/example.js">

The attacker builds DOM elements that contain unexpected things and then loads an existing script (anywhere on the site) that manipulates those elements, trusting they are "sane".

This is an assignment to innerHTML, which is a DOM-based XSS, not a reflected xss. We disable XSSAuditor for document fragments for performance reasons, and unfortunately, XSSAuditor will never be able to catch this.

Blocking reflected "<script src=...>" would stop the example attack. In the real-world example cases the vulnerable page doesn't normally load the unsafe JS. The <script> tag to do the loading is injected.

Blocking doesn't happen because (your link):

// If the resource is loaded from the same host as the enclosing page, it's
// probably not an XSS attack

But it is an attack. I was wondering what kind of website would legitimately pass "<script src=...>" in query parameters. Probably not that many.

Anyway, you probably understand the potential problems of fixing and not fixing it so I have no further comments. Thanks!