search

tildeio / htmlbars

A variant of Handlebars that emits DOM and allows you to write helpers that manipulate live DOM nodes
MIT License
1.61k stars 193 forks source link

IE: A security problem occurred when parsing URLS with embedded credentials #445

Closed ssured closed 8 years ago

ssured commented 8 years ago

For me in IE this line hits a security trigger when run on a https website:

https://github.com/tildeio/htmlbars/blame/master/packages/dom-helper/lib/main.js#L615

this code runs: var a = document.createElement('a'); a.href='https://test.com'; console.log(a.protocol); this code triggers the error: var a = document.createElement('a'); a.href='https://user:pass@test.com'; console.log(a.protocol);

rwjblue commented 8 years ago

What version of IE?

ssured commented 8 years ago

tested the above lines on IE11 on a virtual Win7 system

On IE 10 and IE 9 my app did not load, so my guess is that it is an IE security measure. Could not find anything documented online though.

diogomafra commented 8 years ago

Maybe this is related to this: https://support.microsoft.com/en-us/kb/834489

rwjblue commented 8 years ago

@diogomafra - Thanks for tracking down that article! If that is indeed the issue, I think that even <a href="https://user:pass@test.com"></a> might fail.

@ssured - Can you confirm?

ssured commented 8 years ago

@diogomafra Good find indeed! @rwjblue the behaviour is confirmed, specifying a user&pass makes the url render on IE, but you cannot click the link. I think that should be the behaviour of HTMLbars too. For me HTMLbars crashed on this link, which stopped Ember from rendering anything at all. Chrome and Firefox works fine, which left me with a weird bug which cost me a couple of hours.

ssured commented 8 years ago

I'm fine with closing this issue, as the root cause was my finite knowledge of html. Feel free to reopen if you want this as a reminder for protecting other users falling into the same trap. It is a weird edge case though