Javascript injection in email address as username?

Question

Is it possible for a valid email address (something that would work if used send to gmail, for varying definitions of valid (the email would be received not the exploit)) to contain javascript that could be exploited if rendered and the output is not sanitized (properly encoded)? if so please provide an example.

Answer 1

I would say that theoretically (and practically, depending on your sanitation function), yes, the local part of an email can be used in XSS attacks.

The problem is that email addresses are complex and may include a number of special characters. Additionally, email addresses offer features such as comments and quoted strings, which allow even more special characters.

XSS in Local Part of Email Address

[I'm using the informational rfc3696, because it's a lot nicer to read than the official rfcs.]

The exact rule is that any ASCII character, including control characters, may appear quoted, or in a quoted string.

So a valid email address would be:

"<script>alert(1)</script>"@example.com

You can test its validity here. This is obviously not secure.

Further Possibilities

Even without quoted strings, an attacker can at least get close:

Without quotes, local-parts may consist of any combination of alphabetic characters, digits, or any of the special characters ! # $ % & ' * + - / = ? ^ _ ` . { | } ~

This is already enough to enter a javascript context, eg:

<a href='mailto:USER_EMAIL'>email me</a>

via:

foo'onclick='alert'foo='@example.com

The problem here is that ( is not allowed, but I would not be comfortable printing this to the enduser unencoded. At the very least, a user could change the style: foo'style='color:red'title='imImportant'@example.com.

You can also place the payload inside a comment of the local part, so possible restrictions of your email provider do not apply, eg: ("<script>alert</script>")[email protected], where [email protected] is your email address (here, the same rules as above apply - < and > can only be inside quoted strings; additionally, you cannot have ( and ), even in quoted strings).

And this is just about the local part. The domain part gives an attacker additional attack vectors.

Proper Defense

This is why XSS prevention should not be about filtering, but proper encoding. All dangerous characters (in most contexts - but not all - these are at least ', ", <, and >) should be HTML encoded when send to a user, no matter what filter was applied beforehand.

Answer 2

Further to Tim's excellent answer, Gmail implement a Content Security Policy to prevent any script that manages to bypass their filters from rendering in supported browsers.

So yes, while an email address can contain tags "<script>alert('foo')</script>"@example.com I would be surprised if Google were not correctly encoding it, and as said they have the CSP to protect users if they were not. Having said that, there was a recent bug in the Gmail app in Android which allowed from addresses to look like they were spoofed at first glance.