VULNERABILITY DETAILS
If an HTTPS Document creates a data: worker, and then the worker accesses HTTP subresources (e.g. via Fetch API), mixed content check is not applied to those subresources.
This enables HTTPS pages to have access to HTTP resources by creating data: workers.
According to the spec, this seems to be implemented via HTTPS State propagated from HTTPS Document to data: workers.
VERSION
Chrome Version: 62.0.3189.0 or later.
First bad CL: r495097 https://chromium-review.googlesource.com/567845
Operating System: All (Tested on Linux)
REPRODUCTION CASE
(0) Start local WPT server:
./third_party/blink/tools/run_blink_wptserve.py
and add "127.0.0.1 foobarbaz" to /etc/hosts
(1) Open an HTTPS webpage, say, https://www.google.com/
(2) Open DevTools and execute:
var w = new Worker('data:text/javascript,fetch("http://foobarbaz:8001/worklets/resources/empty-worklet-script-with-cors-header.js", {mode: "cors"}).then(r => postMessage("Bad (resolved)"), r => postMessage("Good (rejected)"));')
w.onerror = () => console.log("ERROR");
w.onmessage = (r) => console.log(r.data);
Expected:
Good (rejected)
Actual:
Bad (resolved)
Related: Issue 880015 (both issues has the root cause that Chromium doesn't implement mixed content checker based on HTTPS state).
Comment 1 by hirosh...@chromium.org
, Sep 3