1590616 - xss bug command

Status: RESOLVED INVALID

(www.mozilla.org :: General, defect)

Description

[u635660]

Attachment: firefox 2.PNG

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0

Steps to reproduce:

1.open firefox
2.search mozilla.org
3.go to google chrome console
4.type this command: javascript:/--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[/[]/+alert(1)//'>

Actual results:

it did a xss alert pop up box.

Expected results:

it should not do a xss alert.

Comment 1

[u635660]

3.open Firefox console *

Comment 2

[Greg G]

Hi planetman1125, thanks for the report!

I'm getting a SyntaxError: invalid regular expression flag t on https://www.mozilla.org/en-US/ on latest Firefox Nightly and Release though I see you're on Firefox 70, which might still be affected.

Are you suggesting users and web developers should not be able to alert from the browser console?

Also it might be worth noting that self-xss is excluded from the bug bounty https://www.mozilla.org/en-US/security/web-bug-bounty/#eligibility

Comment 3

[April King [:April]]

This is not a bug, as it essentially applies to every browser and every website ever created. It's not even really a self-XSS, it's simply telling your browser to execute JavaScript.