1214056 - Firefox OS Browser Hangs After Using a non-reflected XSS payload placed on Meta Tag

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[Jay Turla]

Attachment: Capture.PNG

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36

Steps to reproduce:

This was tested on Firefox version Firefox 41.0.1 on Windows 7 Enterprise.

Firefox hangs after placing the payload below:
data:text/html;charset=utf8,<META HTTP-EQUIV='refresh' CONTENT='0',<script>alert(0)</script>

This makes it impossible to close, navigate to other tabs and options. The remediation as of now for this crash is to use the task manager


Actual results:

When I tried data:text/html;charset=utf8,<META HTTP-EQUIV='refresh' CONTENT='0', placing on the url it didn't hang but when I used the payload:

data:text/html;charset=utf8,<META HTTP-EQUIV='refresh' CONTENT='0',<script>alert(0)</script>

Firefox hangs and couldn't be closed manually.


Expected results:

It shouldn't hang

Comment 1

[Matt Wobensmith [:mwobensmith][:matt:]]

Thanks for the bug report. I've tried on Win7 and Mac, and while it loops repeatedly, I'm able to close the browser without any issues.

Comment 2

[Jay Turla]

Hmmm, that's weird. Yesterday it was working though.

Comment 3

[Jay Turla]

I know that this is out of topic but somehow this issue is currently reproducible via Firefox OS 2.2's web browser. I can't reproduce this anymore with my current Firefox but only on Firefox OS 2.2 only. It's kinda hard to close the browser even though using the home button and you need to close Web IDE to do terminate Firefox OS 2.2.

Comment 4

[Jay Turla]

I changed the product to Firefox OS since it is reproducible with this one.

Comment 5

[Thomas Zimmermann [:tzimmermann] [:tdz]]

That's not an emulator bug. And I don't think it's Firefox OS either.

Comment 6

[Jay Turla]

(In reply to Thomas Zimmermann [:tzimmermann] [:tdz] from comment #5)
> That's not an emulator bug. And I don't think it's Firefox OS either.

I was able to reproduce this using the Firefox Os's web browser version 2.2

Comment 7

[Thomas Zimmermann [:tzimmermann] [:tdz]]

(In reply to Jay Turla from comment #6)
> (In reply to Thomas Zimmermann [:tzimmermann] [:tdz] from comment #5)
> > That's not an emulator bug. And I don't think it's Firefox OS either.
> 
> I was able to reproduce this using the Firefox Os's web browser version 2.2

You'd generally want to set the product/component to where the actual bug is. That is almost certainly Core in this case. Firefox OS is about Gaia, drivers and hardware. Devs won't see the bug if it's categorized incorrectly, I'd suggest to set the old values again and let people figure it out during triage.

Anyway, thanks for reporting this bug in the first place.

Comment 8

[Jay Turla]

(In reply to Thomas Zimmermann [:tzimmermann] [:tdz] from comment #7)
> (In reply to Jay Turla from comment #6)
> > (In reply to Thomas Zimmermann [:tzimmermann] [:tdz] from comment #5)
> > > That's not an emulator bug. And I don't think it's Firefox OS either.
> > 
> > I was able to reproduce this using the Firefox Os's web browser version 2.2
> 
> You'd generally want to set the product/component to where the actual bug
> is. That is almost certainly Core in this case. Firefox OS is about Gaia,
> drivers and hardware. Devs won't see the bug if it's categorized
> incorrectly, I'd suggest to set the old values again and let people figure
> it out during triage.
> 
> Anyway, thanks for reporting this bug in the first place.

Copy :)

Comment 9

[Al Billings [:abillings - ex-MoCo]]

This is minused for bounty because of its "low" security rating. Opening the bug to public as a DOS issue.