Is-element-nonceable should check if the attribute's name |contains| <script or <style> #636

evilpie · 2024-01-12T15:45:44Z

Chrome/Safari both seem to check if <style/</script is contained in the attribute's name, not just an exact match.
@mikewest mentioned this here Prevent nonce stealing by looking for "<script" in attributes of nonced scripts #98 (comment)

(I am actually not quite sure if this is specified correctly, because https://infra.spec.whatwg.org/#ascii-case-insensitive seems to talk about exact matches only?)

annevk

I think you're correct that Infra should probably define an operation for this. Could you file an issue on that against Infra?

At the same time, this is probably clear enough to proceed for now and we can improve it even more later on.

index.bs

…<script/<style>

…<script/<style> (#636) SHA: 459f886 Reason: push, by mozfreddyb Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

annevk approved these changes Jan 15, 2024

View reviewed changes

index.bs Outdated Show resolved Hide resolved

Is-element-nonceable should check if the attribute's name |contains| …

1823169

…<script/<style>

evilpie force-pushed the substring-nonce-name branch from eb21fdd to 1823169 Compare January 15, 2024 11:13

mozfreddyb merged commit 459f886 into w3c:main Jan 15, 2024
2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Is-element-nonceable should check if the attribute's name |contains| <script or <style> #636

Is-element-nonceable should check if the attribute's name |contains| <script or <style> #636

evilpie commented Jan 12, 2024

annevk left a comment

Is-element-nonceable should check if the attribute's name |contains| <script or <style> #636

Is-element-nonceable should check if the attribute's name |contains| <script or <style> #636

Conversation

evilpie commented Jan 12, 2024

annevk left a comment

Choose a reason for hiding this comment