I am opening a bugfix for this, but javascript wasn't even running before from that QR code scan. The URL opened is `http://firefox//open-url?url=javascript:window.close();alert(1337)`, which results in an error page being shown as this can't be navigated. The `firefox://open-url?url=javascript:window.close();alert(1337)` is converted to that URL on the `URIFixUp.getURL` function in [here](https://github.com/mozilla-mobile/firefox-ios/blob/379470e960db8ae0193d939d00e3289b370602f7/firefox-ios/Client/Frontend/Browser/QRCodeViewController.swift#L345). So unless I'm mistaken, I don't see any exploits. But this part of the code still benefit from hardening.
Bug 1868005 Comment 11 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I am opening a bugfix for this, but javascript wasn't even running before from that QR code scan. The URL opened is `http://firefox//open-url?url=javascript:window.close();alert(1337)`, which results in an error page being shown as this can't be navigated. The `firefox://open-url?url=javascript:window.close();alert(1337)` is converted to that URL on the `URIFixUp.getURL` function in [here](https://github.com/mozilla-mobile/firefox-ios/blob/379470e960db8ae0193d939d00e3289b370602f7/firefox-ios/Client/Frontend/Browser/QRCodeViewController.swift#L345). So unless I'm mistaken, I don't see any exploits (see screenshot). But this part of the code still benefit from hardening.