1780479 - XSS via DevTools with eval(location.hash.substring(1));

Status: RESOLVED DUPLICATE of bug 1732543

(DevTools :: Console, defect)

Description

[Syahri Ramadan]

Attachment: 4.jpg

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36

Steps to reproduce:

1. open Firefox browser
2. go to https://www.google.com/search?q=a&source=lmns&bih=961&biw=1461&hl=en&sa=X&ved=2ahUKEwjYsOyMl4f5AhUq7nMBHWwJDVUQ_AUoAHoECAEQAA#dobs=
3. in Dictionary
4. type this: Reflect.apply(alert,null,[document.domain]); in Search for a word bar
5. open devtools (F12)
6. go to console
7. paste this code in console: eval(location.hash.substring(1));

Actual results:

A pop-up alert appears when I paste the code in devtools.

Expected results:

Is it the same as this bug? https://bugzilla.mozilla.org/show_bug.cgi?id=1732543
If this is a duplicate, just close this discussion.
Thank you!

Comment 1

[Syahri Ramadan]

Attachment: 5.jpg

Comment 2

[Daniel Veditz [:dveditz]]

The fact that the console runs arbitrary scripts, and that it's dangerous to paste in scripts from strangers is inherent to what Developer Tools have to do to be useful (in all browsers).

That it happens immediately when you paste or type that string (eager evaluation) is the same as bug 1732543.