1700011 - Issue related to Bookmarks and Javascript code in url field

Status: RESOLVED DUPLICATE of bug 527530

(Firefox :: Security, defect)

Description

[mateuszpraca2223]

Attachment: video_bug.mp4

Version of Mozilla Firefox: 86.0.1 (64 bit)

REPRODUCTION CASE:

1. Open the Mozilla Firefox
2. Go to creating a new bookmark, for example from bookmarks bar:
   2.1 Put the name, for example: test_bug
   2.2 Put the url: javascript:alert(document.domain)
3. Open this bookmark - The alert message will appear
4. Go to, for example: www.google.com and open created bookmark from bookmarks bar - There will appear the alert with information that it is from www.google.com

Mozilla Firefox allows for us to put and execute javascript code instead of address of website in bookmark.

How did I find it:
I found it when I was exploring bookmarks in another browser :) and checked if it is also possible in Mozilla Firefox.

I attached a video that present a bug.

Comment 1

[Johann Hofmann [:johannh]]

Yes, this is called a Bookmarklet https://en.wikipedia.org/wiki/Bookmarklet