362235 - don't parse <script/xss> as a script tag

Status: RESOLVED INVALID

(Core :: DOM: HTML Parser, defect)

Description

[Biju]

Currently firefox treat 

<p>some content</p>
<script/xss src="data:,alert('should not see alert')"></script>
<p>some other content</p>

as if it was

<p>some content</p>
<script src="data:,alert%28%27should%20not%20see%20alert%27%29"></script>
<p>some other content</p>

to reduce XSS, if there is an invalid node name charcter in aby TAG please display the TAG as a 

text.

<p>some content</p>
&lt;script/xss src="data:,alert('should not see alert')"&gt;
<p>some other content</p>

see attachment script_tag_xss.html

PS: close this bug if it is against HTML sec.

Comment 1

[Biju]

Attachment: script_tag_xss.html

Comment 2

[Biju]

credits http://ha.ckers.org/xss.html

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

What do other browsers do?

Comment 4

[Biju]

(In reply to comment #3)
> What do other browsers do?

same, as per http://ha.ckers.org/xss.html

I tried it in IE, got same result
you can test it at
http://www.w3schools.com/html/tryit.asp?filename=tryhtml_basic
using
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>

Comment 5

[Henri Sivonen (:hsivonen)]

Per HTML5, the <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> must be treated equivalently to <SCRIPT XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>.

> PS: close this bug if it is against HTML sec.

Marking invalid.