1850967 - Forbid data: and javascript: URLs in <base>

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Anne (:annevk)]

HTML change: https://github.com/whatwg/html/pull/9665.

Tests: https://github.com/web-platform-tests/wpt/pull/41731.

Comment 1

[Simon Pieters [:zcorpan]]

See https://github.com/whatwg/html/issues/2249#issuecomment-1700567077 for the motivation. In particular, when we align with the URL standard and allow data: as base URLs in general (part of Interop 2023 URL focus area), sites that allow injecting <base href="data:...> (but not http/https) would be vulnerable to XSS.

Comment 2

[Hamish Willee]

MDN docs note:

• Docs for this feature done (track here).
• BCD for Chrome/Safari done in https://github.com/mdn/browser-compat-data/pull/20646
• Dynamic case - HTMLBaseElement - not yet supported by anyone.
• When this goes in, the change will be a BCD update.

Comment 3

[Sean Feng [:sefeng]]

NI myself to take a look

Comment 4

[Frederik Braun [:freddy]]

Tom: Given that this is going to be a useful baseline for the Sanitizer API to build upon (like the <svg><use href="data:..." change that you also implemented), is this something you can take a look at?

Comment 5

[Tom Schuster (MoCo)]

Attachment: Bug 1850967 - Forbid data: and javascript: URLs in <base>. r?emilio

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d50469219667
Forbid data: and javascript: URLs in <base>. r=emilio

Comment 7

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/d50469219667

Comment 8

[Hamish Willee]

FF127 Docs work for this can be tracked in https://github.com/mdn/content/issues/33566

1. The spec that if a javascript or data URL is used in the base element that URL is discarded and the document fallback base URL is used. What is that URL?

   The spec seems to indicate it is the parent document URL for an iframe. Testing indicates it is the location.url for the loaded document - i.e. it falls back to the actual loaded location if you don't specify it in a base element. Can you clarify/confirm?

2. Above it says

   Dynamic case - HTMLBaseElement`` - not yet supported by anyone.

   Is that still correct?

Comment 9

[Tom Schuster (MoCo)]

1. The fallback base URL algorithm is specified here: https://html.spec.whatwg.org/multipage/urls-and-fetching.html#fallback-base-url. I think only for the about base URL case this might be the parent's URL.

2. Judging from this WPT Safari (and Firefox) support it.

Comment 10

[Daniel Veditz [:dveditz]]

Sorry for the burst of bugspam: filter on tinkling-glitter-filtrate
Adding reporter-external keyword to security bugs found by non-employees for accounting reasons