1393880 - Opaque data URL allows mixed content

Status: RESOLVED DUPLICATE of bug 1551886

(Core :: DOM: Security, defect, P3)

Description

[Jun (Request needinfo for comment, I ignore other updates)]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.101 Safari/537.36

Steps to reproduce:

1. Go to https://test.shhnjk.com/iframer.php?url=data:text/html,%3Ciframe/src=http://shhnjk.com%3E
2. Mixed content is loaded.


Actual results:

Treat data URL as opaque origin treated data URL too unique.


Expected results:

HTTP website should not be loaded inside HTTPS site.

Comment 1

[Jun (Request needinfo for comment, I ignore other updates)]

I was waiting for few weeks to get this pref flipped on Nightly. For future reference, does mozilla pay bounty for bug in feature that isn't enabled by default?

Comment 2

[Daniel Veditz [:dveditz]]

Even though data: will no longer inherit the origin, it ought to inherit the "isSecure?" state if it's in an iframe. Or possibly it does and the mixed-content-blocker short-circuits checks against a non-HTTP(s) document.

(In reply to Jun from comment #1)
> I was waiting for few weeks to get this pref flipped on Nightly. For future reference,
> does mozilla pay bounty for bug in feature that isn't enabled by default?

If it's a feature that we intend to ship, yes. If it's still at the experimental stage or intended for special cases (e.g. some of the prefs we added for enterprise use) then often not.

In this case we have a roadmap for shipping this feature so it's definitely in bounds for the bounty.

Comment 3

[Daniel Veditz [:dveditz]]

The browser same-origin policy still protects the site against a malicious use of this technique so its main use would be for a site to try to evade our content-blocking without having to fix their (or 3rd party) content. It's unsafe behavior on the site's part, but if the site is actively malicious it could just leak all your data out the back end. Seems unlikely a legit site will take advantage of this (especially if it's not cross-browser).

Comment 4

[Jun (Request needinfo for comment, I ignore other updates)]

if data URL is loaded in <embed> or <object> tag, Firefox never reload content even if you try hard refresh (Ctrl + F5 on Windows). This is same for any content loaded inside data URL.

PoC
https://test.shhnjk.com/embedder.php?url=data:text/html,%3Ciframe%20src=http://shhnjk.com%3E

This allows http content loaded inside data URL to permanently supply modified content via MITM even after victim left MITM-ed network.

I guess this should be bit more severe (or file another bug for this?).

Comment 5

[Jun (Request needinfo for comment, I ignore other updates)]

Needinfo-ing dveditz for comment 4.

Comment 6

[Daniel Veditz [:dveditz]]

(In reply to Jun from comment #4)
> This allows http content loaded inside data URL to permanently supply
> modified content via MITM even after victim left MITM-ed network.
> 
> I guess this should be bit more severe (or file another bug for this?).

Please file this as a separate bug -- it's not related to this one. I can't imagine very many sites have this set-up so the risk to users would be low.

Comment 7

[Daniel Veditz [:dveditz]]

We've determined that this bug doesn't meet the severity criteria for the Bug Bounty program.

Comment 8

[Niklas]

Marking as duplicate since this is essentially the same as Bug 1551886.

With the patch from Bug 1551886 applied the mixed content on https://test.shhnjk.com/iframer.php?url=data:text/html,%3Ciframe/src=http://shhnjk.com%3E is not loaded.