New issue
Advanced search Search tips

Issue 749891 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 749885
Owner: ----
Closed: Jul 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug



Sign in to add a comment

data: URI scheme issue in Chrome Version 62.0.3168.0 (Official Build) canary (64-bit)

Reported by proof131...@gmail.com, Jul 28 2017

Issue description

Steps to reproduce the problem:

<iframe src='data:text/html,#<script/src=data:%26comma;prompt(location.hash);location.hash="";%26sol;%26sol;%26bsol;%26num;></script>2600<iframe src="https://%26wopf;%26wopf;%26wopf;%26period;2600%26period;%26copf;om/phones%26sol;%26bsol;n%2565win%2564ex%26period;khtml/%26quot;/>`;prompt`${0B101000101000}`</script><script>`"/></iframe><script>prompt`${0B101000101000}`</script>"'/></IFRAME>

If you view the frame source, you will see "view-source:data:text/html,#" try at here: https://jsfiddle.net/m5b9a0g2/

What is the expected behavior?
whole source should be shown when you view-source the frame.

What went wrong?
it shows "data:text/html,#", where syntax after # has been replaced by empty string. There is no problem when you directly open data: uri (since Chrome 60), however this issue arises again when you use Inline Frame.

Did this work before? Yes Version 62.0.3168.0 (Official Build) canary (64-bit)

test link: https://jsfiddle.net/m5b9a0g2/

view the outer frame source, you will see "view-source:data:text/html,#" with in only hash as a context.
 
 
uritest.html
395 bytes View Download
This is short demo video.
test rec.mp4
1.2 MB View Download
Cc: mea...@chromium.org
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug
Mergedinto: 749885
Status: Duplicate (was: Unconfirmed)

Sign in to add a comment