Skip to content
This repository has been archived by the owner on May 10, 2024. It is now read-only.

Disable data URLs in top-level navigation #2424

Open
jumde opened this issue Mar 24, 2020 · 4 comments · May be fixed by #2419
Open

Disable data URLs in top-level navigation #2424

jumde opened this issue Mar 24, 2020 · 4 comments · May be fixed by #2419
Assignees
@Brandon-T
Labels
enhancement Epic: Security priority/P3 The next thing for us to work on. QA/Yes release-notes/exclude security
Projects
Master List

Comments

@jumde
Copy link
Contributor

jumde commented Mar 24, 2020 •
edited
Loading

Description:

Data URLs should not be allowed in top-level navigation

Steps to Reproduce

  1. Navigate to jumde.github.io/test/data1.html
  2. Click Hello

Actual result:
Should not navigate to a data URL

Expected result:
Navigates to a data URL

Reproduces how often: [Easily reproduced, Intermittent Issue]
Easily
@jumde jumde added the security label Mar 24, 2020
@Brandon-T Brandon-T linked a pull request Mar 24, 2020 that will close this issue
Open
7 tasks
@jumde
Copy link
Contributor Author

jumde commented Mar 24, 2020

https://blog.mozilla.org/security/2017/11/27/blocking-top-level-navigations-data-urls-firefox-59/

@diracdeltas diracdeltas mentioned this issue Mar 24, 2020
Closed
@jumde
Copy link
Contributor Author

jumde commented Mar 24, 2020

We'll be using the same exceptions specified in the blog.

@iccub iccub linked a pull request Mar 25, 2020 that will close this issue
Fix #2424: Disabling Synthetic clicks on WebPages #2419
Open
7 tasks
@iccub iccub added this to the 1.15.1 milestone Mar 26, 2020
@iccub
Copy link
Collaborator

iccub commented Mar 30, 2020

Bumping to 1.16 for now since this requires more work and thought, if we will be able to fit it into 1.15.1 I will change the milestone back

@iccub iccub modified the milestones: 1.15.1, 1.16 Mar 30, 2020
@garvankeeley
Copy link

Handy data URL test page: https://www-archive.mozilla.org/quality/networking/testing/datatests.html

@jhreis jhreis added this to To do in Master List via automation Apr 10, 2020
@jhreis jhreis removed this from the 1.16 milestone Apr 22, 2020
@diracdeltas diracdeltas added the priority/P3 The next thing for us to work on. label Oct 27, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@Brandon-T Brandon-T

Labels
enhancement Epic: Security priority/P3 The next thing for us to work on. QA/Yes release-notes/exclude security
Projects
Master List
  
To do
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix #2424: Disabling Synthetic clicks on WebPages brave/brave-ios
6 participants
@diracdeltas @Brandon-T @jumde @jhreis @garvankeeley @iccub