New issue
Advanced search Search tips

Issue 854429 link

Starred by 1 user
Status: WontFix
Owner:
gogerald@chromium.org
Closed: Jun 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 1
Type: Bug-Security



Sign in to add a comment

openWindow in Payment Handler API can open cross-origin url

Reported by s.h.h.n....@gmail.com, Jun 20 2018 
UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.79 Safari/537.36

Steps to reproduce the problem:
1. Go to https://shhnjk.azurewebsites.net/SameSite.php
2. Now go to https://test.shhnjk.com/pay/getsw.html
3. Reload the page (just in case SW isn't ready)
3. Hold Enter key for 3 to 4 seconds

What is the expected behavior?
Error due to redirect to cross-origin url.

What went wrong?
openWindow shouldn't popup new window, and it shouldn't be able to open cross-origin url (redirect normally fails). But when Enter key is hold for some time, openWindow triggers multiple times, resulting to popping up new window with arbitrary cross-origin url. This also bypasses SameSite cookie as demoed in Repro.

Did this work before? N/A 

Chrome version: 69  Channel: canary
OS Version: OS X 10.13.5
Flash Version: 

https://chromium.googlesource.com/chromium/src.git/+/fd7675d7086994ff432cee98272c5903a8c1b68a
Seems to be disabled JIT payment app. But this bug doesn't require JIT payment app (only uses Payment Handler API).

Comment 1 by s.h.h.n....@gmail.com, Jun 20 2018 

Oops, forgot to point to the spec. Step 15 of spec (https://w3c.github.io/payment-handler/#dfn-open-window-algorithm) says:

If the origin of newContext is not the same as the service worker client origin associated with the payment handler, then:
1. Resolve promise with null.
2. Abort these steps.

Comment 2 by s.h.h.n....@gmail.com, Jun 20 2018 

Sorry for the spam. Repro step3 seems unnecessary and rather makes it no-repro. So please skip Repro step3.

Comment 3 by och...@chromium.org, Jun 20 2018

Components: Blink>Payments
Labels: Security_Severity-Medium Security_Impact-Head
Owner: ma...@chromium.org
Status: Assigned (was: Unconfirmed)
mathp, could you please take a look, or help get this assigned to the right person?

Comment 4 by ma...@chromium.org, Jun 20 2018

Owner: gogerald@chromium.org
Project Member

Comment 5 by sheriffbot@chromium.org, Jun 20 2018

Labels: M-69 Target-69
Project Member

Comment 6 by sheriffbot@chromium.org, Jun 20 2018

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 7 by sheriffbot@chromium.org, Jun 20 2018

Labels: -Pri-2 Pri-1

Comment 8 by gogerald@chromium.org, Jun 20 2018 

Redirection is allowed intentionally in the opened window, if the page is redirected out of the scope of the payment handler (service worker), then the service worker loses control of that window.

Reply comment #1:
From what I test, openWindow (window_client) do resolves to null according to the reproducing steps.

Comment 9 by gogerald@chromium.org, Jun 20 2018

Labels: Needs-Feedback

Comment 10 by s.h.h.n....@gmail.com, Jun 20 2018 

If this is intentional, then this might be just a SameSite cookie bug.

Comment 11 by gogerald@chromium.org, Jun 20 2018

Status: WontFix (was: Assigned)
Thanks for reporting, could you help create new bug about the SameSite cookie bug to keep this one separate? Closing this bug as 'WontFix'.

Comment 12 by s.h.h.n....@gmail.com, Jun 20 2018 

gogerald@, do you think this is a different bug than issue 830808 (because it has different logic)?

Comment 13 by gogerald@chromium.org, Jun 20 2018 

I can not find the bug: crbug.com/830808. Could you cc me on that bug?

Comment 14 by s.h.h.n....@gmail.com, Jun 20 2018 

Oh, okay. I don't have permission to CC :D Leave it, I will just add this bug to that bug.
Project Member

Comment 15 by sheriffbot@chromium.org, Sep 27

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment