1389674 - Bookmark this link XSS

Status: RESOLVED DUPLICATE of bug 249747

(Firefox :: Untriaged, defect)

Description

[Jun (Request needinfo for comment, I ignore other updates)]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Steps to reproduce:

1. Go to https://test.shhnjk.com/add_read.html
2. Right click the link and click Bookmark this link
3. Click on saved bookmark and XSS!


Actual results:

Link was pointing to https://bing.com (you can confirm by hover overing it), but when right clicked, it fires oncontextmenu event and changes the URL to javascript URL. Bookmark takes *changed* URL to bookmark, and the fact that added link is not visible before and after bookmark, allowing attacker to silently injecting javascript to bookmark.


Expected results:

URL should be taken more early or URL to be registered to the bookmark should be visible to user.

Comment 1

[:Gijs (he/him)]

(In reply to Jun from comment #0)
> URL should be taken more early 

This is a losing battle, see https://bugzilla.mozilla.org/show_bug.cgi?id=229050#c27 . In any case, even attempting this would also break "legitimate" (or at least, non-sec-exploity, such as tracking) usecases, without ever really fixing the fundamental issue.

> or URL to be registered to the bookmark
> should be visible to user.


bug 371923 seems like the most obvious solution here.

In any case, this is an old, well-known issue.

Comment 2

[Jun (Request needinfo for comment, I ignore other updates)]

14 years old bug!!? Nice :D