1420682 - Possible to append javascript before https - Resulting in XSS on all websites

Status: RESOLVED INVALID

(Firefox :: Address Bar, defect)

Description

[Swapnil]

Attachment: Document.domain.JPG

User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36

Steps to reproduce:

1. Visit https://www.google.com
2.append javascripT://   before https:// so our url will become JavascripT://https://www.google.co.in
3.Add payload %0aalert(document.domain);//https://www.google.co.in after domain name.

so now our final url will be 
JavascripT://https://www.google.co.in%0aalert(document.domain);//https://www.google.co.in


Actual results:

XSS is getting executed.


Expected results:

browser should not process the request, validator should check, that url string must strictly start with http[s]://.

Comment 1

[:Gijs (he/him)]

Typing javascript: code in the URL bar is allowed. This works in other browsers, too. This is not a security issue.