252827 - XSS attack easy to hide

Status: RESOLVED INVALID

(Core :: DOM: HTML Parser, defect)

Description

[Joeph Gama]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040616
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040616

I am creating rules for Snort related to XSS and noticed that Mozilla allows
junk characters after the <SCRIPT and it makes it harder for an IDS to detect it.

<SCRIPT >alert("hi");</SCRIPT>
<SCRIPT	>alert("hi");</SCRIPT>
<SCRIPT%9>alert("hi");</SCRIPT>
<SCRIPT%000009>alert("hi");</SCRIPT>
<SCRIPT%0>alert("hi");</SCRIPT>
<SCRIPT%1>alert("hi");</SCRIPT>
<SCRIPT%31>alert("hi");</SCRIPT>
<SCRIPT%uFFFF>alert('hi');</SCRIPT>
<SCRIPT%uFFEF>alert('hi');</SCRIPT>
<SCRIPT%u0041>alert('hi');</SCRIPT>

Reproducible: Always
Steps to Reproduce:
1.place each line on a text input and submit it to a page that will write it
back on the browser
2.
3.

Actual Results:  
I got the alert.

Expected Results:  
If it accepted only <SCRIPT> it would be better. Ignoring all junk before >
would incerase security.

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

-> html parser... but I really think it's just the IDS that needs to be fixed.

note that mozilla can't just ignroe anything after <script, since it may have
attributes that mozilla needs (src, type, language)

Comment 2

[Boris Zbarsky [:bzbarsky]]

Indeed.  We have to attempt to convert that data to unicode and then tokenize it.

Comment 3

[Daniel Veditz [:dveditz]]

Removing confidential flag from bugs resolved INVALID