search

tildeio / htmlbars

A variant of Handlebars that emits DOM and allows you to write helpers that manipulate live DOM nodes
MIT License
1.61k stars 193 forks source link

Xss vulnerable in URI context with data protocol #435

Open neraliu opened 8 years ago

neraliu commented 8 years ago

It is found htmlbars is XSS vulnerable in URI context as the "data:" protocol does not include in the bad protocol list. currently, some browsers' implementation inherit the original page domain such that attacker can steal the user cookies etc.

The PoC is shown in the latest version of FF 42.0 by injecting the pattern like this data:text/html,<script>alert(document.domain)</script> in the URI.

note: please note that Chrome does not inherit the original page domain.

neraliu commented 8 years ago

related issue is found in this https://github.com/tildeio/htmlbars/issues/406

stefanpenner commented 8 years ago

@neraliu just a headsup, next time it is likely a good idea to report security issues via http://emberjs.com/security/

We may need to add that explicitly to this readme, so that future travelers are aware.

neraliu commented 8 years ago

@stefanpenner I am sorry that I am not aware of this, i will route through that channel to report any findings.

stefanpenner commented 8 years ago

No worries, the readme should say that (but doesn't yet)

ef4 commented 8 years ago

I considered this a vulnerability in Firefox, since every other browser tested provides a safe security context in this situation. So I went through their disclosure process. But they marked it a dup of this issue from 2007:

https://bugzilla.mozilla.org/show_bug.cgi?id=255107

which has been rediscovered and reported at least ten times.

neraliu commented 8 years ago

i would suggest we block this protocol as it allows script execution in most browsers, and FF will inherit the origin domain which is more serious than others.