1835157 - Ignore target names which contain both \n and < characters

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement)

Description

[Jun (Request needinfo for comment, I ignore other updates)]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36

Steps to reproduce:

This is a request on addition to bug 1369029.

Currently, the target attribute in some elements act as an easy way to bypass bug 1369029. In https://github.com/whatwg/html/pull/9309, I proposed an additional mitigation to protect this gap, and it'd be great if y'all can work on this too :)

Comment 1

[Frederik Braun [:freddy]]

This just landed in whatwg/html.

Comment 3

[Tom Schuster (MoCo)]

Attachment: Bug 1835157 - Ignore target names which contain both newline and < characters. r?emilio

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/191c949de34e
Ignore target names which contain both newline and < characters. r=emilio

Comment 5

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/191c949de34e

Comment 6

[Daniel Veditz [:dveditz]]

Sorry for the burst of bugspam: filter on tinkling-glitter-filtrate
Adding reporter-external keyword to security bugs found by non-employees for accounting reasons

Comment 7

[Hamish Willee]

FF128 MDN docs for this can be tracked in https://github.com/mdn/content/issues/33995