javascript - 的 XSS 上的数据 URI 是否可被利用？

Question

看完这篇文章我没有一个明确的答案:

http://palizine.plynt.com/issues/2010Oct/bypass-xss-filters/

• 浏览器会解释 <img> 中的文本/html 数据 URI 负载吗？ src作为文档，其中 <script>标签执行了吗？

• 如果不是，那么在第三方 HTML 中允许数据 URI 是否安全？

• 针对此用例，浏览器级别存在哪些安全机制？

Answer 1

MSDN documentation说 IE 没有:

For security reasons, data URIs are restricted to downloaded resources. Data URIs cannot be used for navigation, for scripting, or to populate frame or iframe elements.

另一方面，Mozilla 确实允许 iframe和 script执行:

data: urls inheriting the origin of their referrer allows them to be used togenerate or window content with which the parent can interact. Geckohas always done it this way (and we've got a lot of security checks scatteredaround that have to worry about it).

Safari和 Chromium沙盒数据 URI 执行，有效地将它们视为跨域请求。

We currently mark data: URIs as having no access to any other origins including other data: URIs.

HTML5 规范指出:

If a Document or image was generated from a data: URL that was returned as the location of an HTTP redirect (or equivalent in other protocols)

The origin is the origin of the URL that redirected to the data: URL.

If a Document or image was generated from a data: URL found in another Document or in a script

The origin is an alias to the origin specified by the incumbent settings object when the navigate algorithm was invoked, or, if no script was involved, of the node document of the element that initiated the navigation to that URL.

If a Document or image was obtained in some other manner (e.g. a data: URL typed in by the user, a Document created using the createDocument() API, a data: URL returned as the location of an HTTP redirect, etc)

The origin is a globally unique identifier assigned when the Document or image is created.

并且 RFC6454 添加了:

A URI is not necessarily same-origin with itself. For example, a data URI [RFC2397] is not same-origin with itself because data URIs do not use a server-based naming authority and therefore have globally unique identifiers as origins.

CSSHTTPRequest library使用数据 URI 执行跨站点 GET 请求，但这是它在所有浏览器上所能执行的最多操作。

引用资料

• HTML Living Standard: Origin

• RFC 6454: The Web Origin Concept