1513470 - Redirect content is shown when redirecting to an invalid data URI

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[Wladimir Palant]

When a website serves up a redirect, it can provide some HTML content along with it. In the past, web browsers used to display that content under some circumstances. As a result, open redirect vulnerabilities in websites would occasionally be "upgraded" into XSS vulnerabilities (see bug 255119). So now Firefox will display "Corrupted Content Error" instead, which prevents such issues.

There are apparently loopholes however. I already filed one under bug 1506821, and the challenge under https://www.bugbountynotes.com/challenge?id=18 makes use of another (presumably based on a real vulnerability found in a web application). Redirecting to a data: URI will normally be blocked. However, if that data: URI is supposed to be base64-encoded yet the contents aren't valid base64, Firefox will still fall back to displaying redirect content.

For testing:

* https://palant.de/test/data_redirect/ - redirects to data:text/html;base64,Zm9vYmFy and fails silently (Navigation to toplevel data: URI not allowed).
* https://palant.de/test/data_redirect_invalid/ - redirects to data:text/html;base64,<foobar> and displays redirect content (302 Found).

Reproduced in Firefox 63 on Kubuntu. Chrome 71 displays ERR_UNSAFE_REDIRECT for both URLs.

Comment 1

[Honza Bambas (:mayhemer)]

I can take a look

Comment 2

[Honza Bambas (:mayhemer)]

The reason we show the redirect response content is that opening the data channel in nsHttpChannel::ContinueProcessRedirection failed (AsyncOpen returns NS_ERROR_ILLEGAL_VALUE).

converting to (or returning from AsyncOpen) NS_ERROR_MALFORMED_URI (both reasonable) this will prevent rendering.

I want to alter how nsDataChannel::OpenContentStream behaves.  This can have some impact...

Comment 3

[Honza Bambas (:mayhemer)]

Attachment: v1

see previous comment for rational.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=2cd27535a9d1309faf8cfdc6e9a0d720a82c96d7

Comment 4

[Honza Bambas (:mayhemer)]

Try looks good !

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/048bb05eebbc
Block redirect content from being shown when target data URL is broken, r=dragana

Comment 6

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/048bb05eebbc