Bugtraq mailing list archives
Re: <BASE> tag used for hijacking external resources (XSS)
From: Bouke van Laethem <vanlaethem () gmail com>
Date: Fri, 16 Dec 2011 22:44:05 +0100
On Fri, Dec 16, 2011 at 9:59 PM, Mario Vilas <mvilas () gmail com> wrote:
Makes sense as a trick to bypass some crappy XSS filters that look for strings like "javascript:", but I don't think it's a vulnerability in itself.
I would consider it a browser bug (although I agree it would mostly be abused through bypassing what you refer to as "crappy XSS filters"), because the browsers are going too far out of their way to parse invalid html.
From http://www.w3.org/TR/html4/struct/links.html#h-12.4:
When present, the BASE element must appear in the HEAD section of an HTML document, before any element that refers to an external source. The path information specified by the BASE element only affects URIs in the document where the element appears. w3.org doc also refers to RFC1080, http://www.ietf.org/rfc/rfc1808.txt: 10, Appendix: [...] HTML defines a special element "BASE" which, when present in the "HEAD" portion of a document, signals that the parser should use the BASE element's "HREF" attribute as the base URL for resolving any relative URLs. The "HREF" attribute must be an absolute URL.
Current thread:
- <BASE> tag used for hijacking external resources (XSS) Bouke van Laethem (Dec 16)
- Re: <BASE> tag used for hijacking external resources (XSS) Jann Horn (Dec 16)
- Re: <BASE> tag used for hijacking external resources (XSS) Mario Vilas (Dec 19)
- Message not available
- Re: <BASE> tag used for hijacking external resources (XSS) Bouke van Laethem (Dec 19)
- Re: <BASE> tag used for hijacking external resources (XSS) Mario Vilas (Dec 19)
- Re: <BASE> tag used for hijacking external resources (XSS) Bouke van Laethem (Dec 19)
- Re: <BASE> tag used for hijacking external resources (XSS) Mario Vilas (Dec 19)
- Re: <BASE> tag used for hijacking external resources (XSS) Jann Horn (Dec 16)