1531601 - css exfil protection (protection against attribute selectors extracting data from HTML attributes)

Status: UNCONFIRMED

(Core :: CSS Parsing and Computation, defect, P3)

Description

[jwms]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0

Steps to reproduce:

visit this CSS Exfil Vulnerability Tester
https://www.mike-gualtieri.com/css-exfil-vulnerability-tester

Actual results:

See faces

Expected results:

I would get green checkmarks

further information
https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense
https://addons.mozilla.org/en-US/firefox/addon/css-exfil-protection/
https://github.com/mlgualtieri/CSS-Exfil-Protection

Comment 1

[jwms]

I couldn't find a bug report for this topic so I figured I'd put one in on it

Comment 2

[Andrew McCreight [:mccr8]]

I'm going to unhide this because it is based on a year-old blog post.

David, any thoughts?

Comment 3

[Cameron McCormack (:heycam)]

FWIW Xidorn raised this in the CSSWG last year, but he came to the conclusion that it's an issue for framework developers rather than browsers and their selector matching: https://github.com/w3c/csswg-drafts/issues/2339

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I'd note that I think the blog post rather overstates the severity of these attacks because form controls don't (in the platform) reflect user input into the value attribute. Instead, the defaultValue DOM property reflects the HTML value attribute, and the value DOM property contains the user input.

However, some frameworks (e.g., react) may change this model.

So I think this is a problem that applies to pages that use certain frameworks but not pages in general.

I suppose the suggested fix here is to break cross-domain image loading when it's triggered from an attribute selector. It's not clear to me what the tradeoff is between (a) sites that would be broken and (b) developers that would be confused against any security benefits to sites that use such frameworks and would hit this issue.