746425 - Bypass Content-Security-Policy using E4X

Status: RESOLVED DUPLICATE of bug 722547

(Core :: DOM: Core & HTML, defect)

Description

[Yosuke HASEGAWA]

User Agent: Mozilla/5.0 (Windows NT 6.0; rv:12.0) Gecko/20100101 Firefox/12.0
Build ID: 20120411064248

Steps to reproduce:

E4X feature helps to break CSP.

HTML file is recognizable as JavaScript source with E4X feature, when no doctype or no XML declaration is given. It helps to running arbitrary js code when xss occurred, even if content is protected by Content-Security-Policy.




Actual results:

Visit following URL and raise "alert".
http://utf-8.jp/cgi-bin/csp.cgi?q=%3Cscript%20src%3d%22?q%3d%3C/div%3E%3C/body%3E%3C/html%3E;alert%281%29;%3Chtml%3E%3Cbody%3E%3Cdiv%3E%22%3E%3C/script%3E



Expected results:

Disable E4X feature for CSP protected content, or need other solution.

Comment 1

[Masatoshi Kimura [:emk]]

Why is this bug confidential? The attack surface is already public.
https://www.google.co.jp/search?q=owaspj-csp.pptx (Japanese)
FYI, you can parse HTML as JS even without E4X.
http://bakera.jp/ebi/topic/4755/comment (again Japanese)

Comment 2

[Yosuke HASEGAWA]

Confidential is not unintended. my intention is to specify clearly security issue.
Although this issue is minor, It can't harm to many users, I think.

example of bypass CSP without E4X is incredibly rare case more than this issue, you know. HTML comment before meta elm is indispensable prerequisite.

Comment 3

[Daniel Veditz [:dveditz]]

What exactly is the bypass here? Haven't debugged but the CSP is "default-src 'self'" and the script tag appears to be loading itself. Is this just a duplicate of the fact that we're not checking the content-type for scripts? I don't think it's fair to blame E4X for this.

Comment 4

[Masatoshi Kimura [:emk]]

Is it possible to add "strict-mime" option to CSP? It is more fundamental and will also prevent the comment #1 attack.
BTW, let's unhide this bug for broader audience. The attack vector is already public.

Comment 5

[Daniel Veditz [:dveditz]]

Originally the default specified behavior was strict content type checking for scripts (see bug 662227), but that has dropped out of the spec. I'd much rather have default strict checking with a 'lax-content-type' option than the reverse because people aren't going to remember to use 'strict-mime'.