New issue
Advanced search Search tips

Issue 723999 link

Starred by 2 users
Status: WontFix
Owner: ----
Closed: May 2017
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Security



Sign in to add a comment

XSS Auditor Bypass via OnAuxClick

Reported by mishra.d...@gmail.com, May 18 2017 
UserAgent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:45.0) Gecko/20100101 Firefox/45.0

Steps to reproduce the problem:
Code :

<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.setXSSAuditorEnabled(true);
}
</script>
</head>
<body>
<button onauxclick=alert(1)>Right-Click Me</button>
</body>
</html>

What is the expected behavior?

What went wrong?
Please save the above code in .html and right click on the respective button, it generates an XSS.

Did this work before? N/A 

Chrome version: 58.0.3029.110 (Official Build) (64-bit)  Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version:

Comment 1 by elawrence@chromium.org, May 18 2017

Status: WontFix (was: Unconfirmed)
Summary: XSS Auditor Bypass via OnAuxClick (was: XSS Auditor Bypass)
This doesn't represent a cross-site scripting vulnerability. The page itself contains script that runs when the auxiliary click event fires (e.g. right-clicking).

The window.testRunner code above suggests that this code was copied out of a test suite somewhere. Where is it from?

Comment 2 by mishra.d...@gmail.com, May 18 2017 

The refrence was taken from Bug ID 690028#c5, Tom shared a link for one of my test case.

Comment 3 by elawrence@chromium.org, May 18 2017 

This bug seems to reflect the same confusion as shown in 690028. The XSS Auditor does not ever block script from executing in the page unless the XSS Auditor can determine that the script in question was supplied in the URL or a POST body that was sent to the target page. 

Simple execution of script in HTML does not suggest a bypass of the XSS Auditor.
Project Member

Comment 4 by sheriffbot@chromium.org, Aug 25 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment