Exploiting mailto links

Question

Supposing that the user has the power to include any content after mailto: snippet, are there any possible security vulnerabilities?

Example:

The user says their email address is foo. The link on the page (which is visible to everyone), will be be: <a href="mailto:foo">foo</a>.

I'm interested to know if there is a way to exploit this thing.

SilverlightFox · Accepted Answer · 2015-05-19 10:29:46Z

4

What if they entered their email as

"></a><script>alert("XSS")</script><a href="

which (might) be rendered by the application as

<a href="mailto:"></a><script>alert("XSS")</script><a href="">"></a><script>alert("XSS")</script><a href="</a>.

To prevent this, the application should URL percent encode and then HTML encode the email value.

answered May 19, 2015 at 10:29

SilverlightFox

33.2k6 gold badges66 silver badges177 bronze badges

That's a good point. However, that's an encoding issue. Are there other ways to exploit this case?
– Ionică Bizău
May 19, 2015 at 10:51
@IonicăBizău perhaps you need to define your scope of "exploit" - this answer shows a way to exploit the HTML.
– schroeder ♦
May 19, 2015 at 15:26
@schroeder I'm just curious if there's a way to break the things since the email is not validated.
– Ionică Bizău
May 19, 2015 at 16:07

Add a comment |

1 Answer 1