News for hackers. Stuff that matters.

A comment on Arbitrary code execution through unsanitized browser UI.

Re:Arbitrary code execution through unsanitized browser UI by orf on Wednesday January 31, 2018 @06:17PM (#16278450)
Well, here is the patch with a relevant test: https://reviewboard.mozilla.org/r/215474/diff/3#index_header

Seems to create an iFrame, sets the source to "chrome://global/content/win.xul", then creates a div (with a NS) inside it and sets the content to:

   <a onclick="foo()" href="javascript:foo"><script>bar()<\/script>Meh.</a><a href="http://foo/"></a>
The expected results is the div contents is:

   <a>Meh.</a><a href="http://foo/"></a>
[ Parent | on HN ]
Re:Arbitrary code execution through unsanitized browser UI by gsnedders on Wednesday January 31, 2018 @07:48PM (#16278909)
Nah, that test relies on being run with chrome privileges. Firefox refuses to even load such a page within an iframe ordinarily.
[ Parent | on HN ]