437618 - legacy String methods may expose sites to XSS (aka, the most silly bug ever)

Status: RESOLVED DUPLICATE of bug 352437

(Core :: JavaScript Engine, defect)

Description

[Michal Zalewski]

Ok, this might be the dumbest thing I've ever spotted, and I'm filing it for your amusement, mostly... 

Javascript String class supports a number of legacy functions such as .anchor, .fontcolor, etc, to somehow "simplify" generating HTML. Of what use they would be, what do they simplify, or why would anyone in their right mind put them in String is beyond me.

However, if these are ever, by a stretch of imagination, ever used by anyone to actually select font colors, sizes, or produce other bits of HTML on attacker-controlled input - well, these are trivially vulnerable to cross site scripting due to insufficient escaping, and would expose the site that relies on this in an unexpected and undocumented manner. Amusingly enough, the same brokenness is populated across MSIE, Firefox, Safari, and Opera.

javascript:"foo".anchor("hello\"><script>alert(1)</script>")
javascript:"foo".fontcolor("hello\"><script>alert(1)</script>")
javascript:"foo".fontsize("hello\"><script>alert(1)</script>")
javascript:"foo".link("hello\"><script>alert(1)</script>")

You probably want to fix it (or just kill these altogether).

/mz

Comment 1

[Jeff Walden [:Waldo]]

I think this is a dup of bug 352437, and given its longstandingness and ease of discovery I don't really think it needs to be hidden.  Anyone disagree?

Comment 2

[Brian Crowder]

I agree with Waldo.

Comment 3

[Michal Zalewski]

Oopsey - yeah, I don't think it needs to be hidden.