XSS Auditor non-functional on iOS
Reported by
namburi....@gmail.com,
Jul 16 2017
|
||||||||||||
Issue descriptionSteps to reproduce the problem: 1. Open link http://demo.testfire.net/search.aspx?txtSearch=%3Cimg+src%3D%22https%3A%2F%2Fwww.google.com%2Fimages%2Fbranding%2Fgooglelogo%2F2x%2Fgooglelogo_color_272x92dp.png%22+onerror%3D%22alert%28%27XSS%27%29%22%2F%3E++++ in chrome browser (Desktop-MAC book). 2. "ERR_BLOCKED_BY_XSS_AUDITOR" error is shown. 3. Open the same link (http://demo.testfire.net/search.aspx?txtSearch=%3Cimg+src%3D%22https%3A%2F%2Fwww.google.com%2Fimages%2Fbranding%2Fgooglelogo%2F2x%2Fgooglelogo_color_272x92dp.png%22+onerror%3D%22alert%28%27XSS%27%29%22%2F%3E++++) in Chrome browser (IOS-Iphone). 4. HTML Injection/XSS Script injection is possible. Google image is loaded in demo.testfire.net web page. What is the expected behavior? I hope same behaviour should be present across Desktop and mobile, that IOS browser should disallow the XSS (script) to be rendered. What went wrong? HTML Injection/XSS Script injection is possible in IOS Chrome browser. Did this work before? N/A Chrome version: 59.0.3071.102 Channel: stable OS Version: OS X 10.12 Flash Version:
,
Jul 20 2017
Hi Eugene, is this something we can fix in WKWebview?
,
Jul 20 2017
Eric, do you know if XSSAuditor is a part of Blink or it's just a SafeBrowsing feature?
,
Jul 20 2017
tsepez@ knows infinitely more about this than I do. Chrome's XSSAuditor now lives in blink (third_party/WebKit/Source/core/html/parser/XSSAuditor.cpp), but I believe it existed in WebKit before the divorce and that Safari has a version of the feature as well (see e.g. https://bugs.webkit.org/show_bug.cgi?id=92692) Searching around, I see references to "xssAuditorEnabled setting in Webcore" and "setXSSAuditorEnabled on WebPreferences" but I don't know whether these flags or similar exist in a useful way on the WKWebView object. I didn't see anything obvious in the configuration https://developer.apple.com/documentation/webkit/wkwebviewconfiguration
,
Jul 20 2017
On iOS, Chrome integrates with the iOS frameworks at a higher level than where the XSSAuditor lives, so its currently not possible to do anything about this.
,
Jul 20 2017
Removing Blink>SecurityFeature>XSSAuditor label and turning this into FeatureRequest There is always an option to contribute to WebKit (cc danyao@ for that).
,
Jul 20 2017
As noted in #4, I'm pretty sure this is still in WebKit, but the question is whether WKWebview exposes it for us to opt-into?
,
Jul 25 2017
,
Aug 1 2017
A quick websearch didn't show any documentation for this capability in WKWebView, and I'm not the person to add it. Re-assigning.
,
Aug 1 2017
Marking as Available as I will not have time to work on this in the near future. Danyao (CCed to this bug) can make a judgement whether this feature request is important or not.
,
Apr 2 2018
Marking as external dependency since no one can make any progress on this unless things change in iOS.
,
Oct 26
,
Oct 26
|
||||||||||||
►
Sign in to add a comment |
||||||||||||
Comment 1 by elawrence@chromium.org
, Jul 16 2017Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug
Summary: XSS Auditor non-functional on iOS (was: Possibility of XSS/HTML Injection (Chrome-IOS))