Improve XSSAuditor warning strings. |
|
Issue descriptionFrom bug 898081 : ... We have been experiencing difficulty explaining to developers at scale, why they should fix the bugs even when the browser says the attack was stopped ... Furthermore, we've surveyed security pentesters and found out some do not report vulnerabilities unless they can find a bypass of the XSSAuditor. So ... Improve the security warning messaging so that it implies a security vulnerability was detected
,
Oct 23
The next question becomes: Which message are you talking about? The one on the interstitial error page that is seen by the user and is of no use to them? Or the one in the developer tools console?
,
Oct 23
I think it would be useful to just survey developers and ask them what they see on both. Anyway, some random examples: The interstitial makes people (often those int the team doing triage/prioritization of bugs) think the site is offline, if the intersitial page clearly said that a vulnerability was detected it would be less confusing, for example: b/63440687#comment2 The error on the console is also an issue, since developers don't know what to look for, and what's the problem, for example: b/12108541#comment22 or they think Chrome is safe b/25811342#comment1 The auditor triggered in the 3 bugs above, and the 3 times it could be trivially bypassed. They were not cherrypicked.
,
Oct 23
for future reference, this is what the interstitial says: http://evilwebsite.com/xss.php?nofilheader&xxp=1&plain_xss=%3Cscript%3Ealert(1)%3C/script%3E This page isn’t working Chrome detected unusual code on this page and blocked it to protect your personal information (for example, passwords, phone numbers, and credit cards). Try visiting the site's homepage. ERR_BLOCKED_BY_XSS_AUDITOR
,
Oct 23
and this is what the error in the console says: http://evilwebsite.com/xss.php?&plain_xss=%3Cscript%3Ealert(1)%3C/script%3E The XSS Auditor refused to execute a script in 'http://evilwebsite.com/xss.php?&plain_xss=%3Cscript%3Ealert(1)%3C/script%3E' because its source code was found within the request. The server sent an 'X-XSS-Protection' header requesting this behavior. |
|
►
Sign in to add a comment |
|
Comment 1 by tsepez@chromium.org
, Oct 23