1229887 - XSS hazard: HTML body text interpolated as <script> content through backticks

Status: RESOLVED INVALID

(Core :: DOM: HTML Parser, defect)

Description

[Daniel Veditz [:dveditz]]

Attachment: alerttest.html

serazoli reported odd behavior to the security alias: HTML body text is being interpolated into a script tag due to backticks. A document consisting of:

  alert('aaa');             
  `<script src=""></script>`

Will display the expected body text

   alert('aaa')` `

but it will also unexpectedly fire the alert.

I didn't think that was how ES6 template strings worked, and in any case this is HTML body text and not in JS.

Comment 1

[Daniel Veditz [:dveditz]]

My expected results text above is wrong, Firefox does also show the semi-colon as you'd expect (see the attachment).

Henri: any idea what the parser is doing here?

Comment 2

[Daniel Veditz [:dveditz]]

Attachment: Original PoC

The original PoC had quite a bit more HTML markup inside the grave-quoted string between the alert text and the script tag. I edited it down for a minimal testcase but it's somewhat interesting to see how far back the script tag can reach.

Comment 3

[Jeff Walden [:Waldo]]

Oh!  Right!  Jesse pointed out to me that <script src=""></script> resolves the empty-string location to the current location.  So then you have an HTML page with some garbage text that includes a script element that loads the page as a script.  Then the page source evaluates an alert() call as one expression/statement, then evaluates a template string containing a script element with no observable side effect.

So, this is working basically the way it should.  The weird thing is that src="" will load the current page as a script.  Once you do that, you get whatever is in the current page, that happens to evaluate as a script.  I don't think, once you set aside the load of a script with executable contents, there's anything worrisomely XSS about this.

Comment 4

[Daniel Veditz [:dveditz]]

Thanks Jesse! 

In a real page that someone's trying to XSS there's a vanishingly small chance that the entire page will correctly evaluate as a syntactically valid script, and any syntax error prevents execution of anything.

The given testcase doesn't work on Chrome (maybe they don't support ` strings yet), and apparently they don't treat src="" as a self-reference, but with a minor modification this behavior works in other browsers, at least when loaded from a file: url. I've heard Chrome is going to require (has?) correct Content-Type for <script> source files, but that has to be relaxed for file: urls.

  alert('aaa');
  ' <script src="#foo"></script> '    

Surprising behavior, but makes sense in hindsight.