Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

[hackerone] window.close should be blocked unless the script also opened the tab #5006

Closed
bridiver opened this issue Oct 20, 2016 · 4 comments
Closed

[hackerone] window.close should be blocked unless the script also opened the tab #5006

bridiver opened this issue Oct 20, 2016 · 4 comments
Labels
QA/checked-macOS QA/checked-Win32 QA/checked-Win64 security
Milestone
0.12.7dev

Comments

@bridiver
Copy link
Collaborator

Did you search for similar issues before submitting this one?
Yes

Describe the issue you encountered:
From https://hackerone.com/reports/176197
It is possible for a tab to close itself even if the tab was not opened by a script. In Chrome this is blocked with the message Scripts may close only the windows that were opened by it which is controlled by webkit DOMWindow.cpp DOMWindow::close.

Expected behavior:
window.close should only allow a tab to be closed if it was opened by the script

  • Platform (Win7, 8, 10? macOS? Linux distro?):
    All
  • Brave Version:
    0.12.5
  • Steps to reproduce:
    1. Open a page with
<html>
<title>Brave Window Object Remote Denial of Service.</title>
<head></head>

<body><br><br>
<h1><center>Brave Window Object Remote Denial of Service</center></h1><br><br>
<h2><center>Proof of Concept</center></br></br> </h2>

<center>
<b>Click the below link to Trigger the Vulnerability..</b><br><br>
<hr></hr>

<hr></hr>
<b><center><a href="javascript:window.close(self);">Brave Window Object DoS Test POC</a></center>

</center>
</body>

</html>
@diracdeltas diracdeltas added this to the 0.12.7dev milestone Oct 24, 2016
@diracdeltas diracdeltas changed the title window.close should be blocked unless the script also opened the tab [hackerone] window.close should be blocked unless the script also opened the tab Oct 24, 2016
@diracdeltas
Copy link
Member

the PoC no longer works for me in the latest release. console shows the error

Scripts may close only the windows that were opened by it.

@diracdeltas
Copy link
Member

closing because i can't find a way to get a window to close itself in the latest build or on master; please reopen if you can @bridiver

@diracdeltas
Copy link
Member

diracdeltas commented Oct 25, 2016 •
edited
Loading

test plan:

  1. check that going to feedly and logging in closes the login window
  2. go to http://web.mit.edu/zyan/Public/close.html, click the link and verify that the window does not close
  3. click the button under the link and verify that it opens a window
  4. click the link in the new window, verify that now it closes

@diracdeltas diracdeltas reopened this Oct 25, 2016
@diracdeltas
Copy link
Member

i got confused and reopened this because the PoC was successful if the link above was clicked to open in a new tab. but that seems like the intended behavior because it works the same in chrome.

diracdeltas added a commit that referenced this issue Oct 25, 2016
@diracdeltas
Add test for window opening and closing
64bf29a 
address #5006

Auditors: @bridiver

Test Plan: n/a
This was referenced Oct 26, 2016
Closed
Closed
Closed
@luixxiul luixxiul mentioned this issue Oct 26, 2016
Closed
This was referenced Oct 27, 2016
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
QA/checked-macOS QA/checked-Win32 QA/checked-Win64 security
Projects
None yet
Milestone
0.12.7dev
Development

No branches or pull requests
5 participants
@bridiver @diracdeltas @alexwykoff @luixxiul @srirambv