Chrome blocks preview with ERR_BLOCKED_BY_XSS_AUDITOR

[Ryan J Ollos]

Issue occurs when using WikiProcessor in text such as:

{{{#!html
<form action="">
}}}

The workaround noted by Jun is to add X-XSS-Protection: 0 header when the method is POST (or to add the header to all preview features).

More info in ​X-XSS-Protection.

[Ryan J Ollos]

Milestone renamed

[Ryan J Ollos]

I'm not sure this is the right solution since it depends on inspecting args for the preview key:

trac/web/api.py

@@ -684 +684 @@
         self.send_header('Cache-Control', 'must-revalidate')
         self.send_header('Expires', 'Fri, 01 Jan 1999 00:00:00 GMT')
         self.send_header('Content-Type', content_type + ';charset=utf-8')
+        if self.method == 'POST' and 'preview' in self.args:
+            self.send_header('X-XSS-Protection', 1)  # Ticket #12926
         if isinstance(content, basestring):
             self.send_header('Content-Length', len(content))
         self.end_headers()

Any ideas for improvement?

[Jun Omae]

I noticed other rare cases.

1. Using comment of wiki page:
   1. Edit any wiki page
   2. Enter [[html(<form action="">)]] to comment of the page
   3. Click Review Changes or Preview Page button
2. Using arguments of newticket page:
   1. Visit https://trac.edgewall.org/demo-1.0/newticket?description=[[html(%3Cform%20action=%22%22%3E%29%5D%5D

[Jun Omae]

I don't think it is good to use self.args to detect preview feature….

Instead, what about to disable XSS protection when method is POST and Content-Type is text/html?

trac/web/api.py

@@ -339 +339 @@
         self._write = None
         self._status = '200 OK'
         self._response = None
+        self._content_type = None
 
         self._outheaders = []
         self._outcharset = None
@@ -461 +462 @@
         """
         lower_name = name.lower()
         if lower_name == 'content-type':
+            self._content_type = value.split(';', 1)[0]
             ctpos = value.find('charset=')
             if ctpos >= 0:
                 self._outcharset = value[ctpos + 8:].strip()
@@ -472 +474 @@
         """Must be called after all headers have been sent and before the
         actual content is written.
         """
+        if self.method == 'POST' and self._content_type == 'text/html':
+            # Disable XSS protection (#12926)
+            self.send_header('X-XSS-Protection', 0)
         self._send_cookie_headers()
         self._write = self._start_response(self._status, self._outheaders)
 

[Ryan J Ollos]

I'm unsure of the consequences of adding the heading for all POST requests. Please feel free to take ownership of the ticket if you'd like to push the fix.

[Ryan J Ollos]

Committed to 1.0-stable in r16495, merged in r16496, r16497.

[matthewcotton.cs@…]

I realize this was closed recently, but I wanted to note that in Trac 1.2.2 — coupled with Chrome Version 66.0.3359.139 — there are still issues with this bug. Specifically, when trying to embed an iframe wrapped with the {{{#!html ... }}} syntax.