1094795 - XSS auditing

Status: RESOLVED DUPLICATE of bug 528661

(Core :: Security, defect)

Description

[David Teller [:Yoric] - still alive but not very active]

Apparently, Chrome/Opera has a XSS prevention feature.

e.g. following
http://berghain.de/events/%22%20onmouseover=%22alert%28%27NEIN!%27%29

will introduce a XSS in Firefox, but not in Chrome/Opera (the XSS is triggered by mouseover on the link to the right of the screen).

We should investigate this.

Comment 1

[David Teller [:Yoric] - still alive but not very active]

When loading the page in Opera, their console displays

The XSS Auditor refused to execute a script in 'http://berghain.de/events/%22%20onmouseover=%22alert%28%27NEIN!%27%29' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header. 

I haven't checked the contents of the page, but our devtools shows up the XSS as a separate source, so that looks like something we could easily detect, too.