1418642 - Loading toplevel data URLs for images, plaintext, pdfs

Status: RESOLVED INVALID

(Core :: DOM: Security, defect)

Description

[Jun (Request needinfo for comment, I ignore other updates)]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36

Steps to reproduce:

1. Go to https://vuln.shhnjk.com/xssable.php?xss=%3Cscript%3Elocation.href=%22data:,test%22%3C/script%3E


Actual results:

data URL loaded on top


Expected results:

Nightly turned on "security.data_uri.block_toplevel_data_uri_navigations" to true by default. But there is regression somewhere which allowed loading data URL on top.

Comment 1

[Alice0775 White]

Due to Bug 1415612 ?

Comment 2

[Alice0775 White]

range:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a0e98ae937a20699d244f65e89ca2a8c41f92f8c&tochange=479f3105ad3bdc7e777ff9cf11bcae713b465c96

Seems by design

Comment 3

[:Gijs (he/him)]

(In reply to Alice0775 White from comment #2)
> range:
> https://hg.mozilla.org/integration/mozilla-inbound/
> pushloghtml?fromchange=a0e98ae937a20699d244f65e89ca2a8c41f92f8c&tochange=479f
> 3105ad3bdc7e777ff9cf11bcae713b465c96
> 
> Seems by design

Thanks for finding that, Alice. Makes sense to me... Christoph, should this be closed?

Comment 4

[Jun (Request needinfo for comment, I ignore other updates)]

Images too.

https://vuln.shhnjk.com/xssable.php?xss=<script>location.href="data:image/png,test"</script>

Comment 5

[Masatoshi Kimura [:emk]]

Although the bug 1415612 title is a bit misleading, it also whitelists images (exccept SVG).

Comment 6

[:Gijs (he/him)]

(In reply to Jun from comment #4)
> Images too.
> 
> https://vuln.shhnjk.com/xssable.php?xss=<script>location.href="data:image/
> png,test"</script>

That was changed in bug 1396798, though it excludes SVG.

Comment 7

[Christoph Kerschbaumer [:ckerschb}]

Toplevel data: URI navigations to plain text types are allowed. If you change your test to use 'data:text/html', like:
https://vuln.shhnjk.com/xssable.php?xss=%3Cscript%3Elocation.href=%22data:text/html,test%22%3C/script%3E
then the navigation will be blocked and you'll see the following message in the console:
> Navigation to toplevel data: URI not allowed (Blocked loading of: “data:text/html,test”)

In other words, this is expected behavior. I am working on a blogpost what navigations are allowed and what are blocked which will appear on blog.mozilla.org/security/ next week; in the meantime you can find more inforamtion here:
https://www.fxsitecompat.com/en-CA/docs/2017/data-url-navigations-on-top-level-window-will-now-be-blocked/