1447855 - leaking cross-origin history on iOS

Status: RESOLVED WORKSFORME

(Firefox for iOS :: General, defect)

Description

[Khalil Zhani]

Attachment: screenshot

1. Load https://attack.shhnjk.com/get_resource.html
2. Observer 

The alert is shown with "shhnjk.com/?secrect".

The problem here is that PerformanceAPI's ResourceTiming exposes the post-redirection URL of a cross-origin resource.

The POC does not seem to reproduce in Safari 11.0.3 or Safari Tech Preview 11.2.

Comment 1

[Daniel Veditz [:dveditz]]

Odd that Safari on iOS wouldn't exhibit the same problem. the Performance API is a feature of the webkit view, not anything Firefox has direct control over.

Stefan: can you get this bug reported upstream to Apple, please?

Comment 2

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

This seems to be fixed in iOS 11 and 12. I am unable to reproduce this issue on either Safari on iOS 11.4 or iOS 12.0. Or on Firefox 13.2 on either of those iOS versions.

Closing as WORKSFORME but also Cc to Dan to find out if that is correct.

(Apple is not going to fix iOS 10 bugs - AFAIK all devices that run 10 can also update to 11.4)

Comment 3

[Daniel Veditz [:dveditz]]

I'm fine not fixing it on iOS 10 if it's fixed on newer versions.