19

So I learned something rather surprising today and it's pretty scary. I'm actually stunned neither Chrome/Google, nor Mozilla, have plugged it. First, the logistics of how I ran across this

  1. I linked to a page in chat (I want you to read this first so the link is at the end). Pretty benign site
  2. Someone in chat clicked the link later.
  3. That page then hijacked the chat window and redirected it

Now, what's cool is this site is trying to raise visibility of a pretty serious problem with JavaScript. I'd not heard of this before and it's quite the gaping security hole. As in this could do bad things right now.

When a website uses target="_blank" on their links in order to open a new tab or window, that website gives the new page access to the existing window through the window.opener API, allowing it a few permissions. Some of these permissions are automatically negated by cross-domain restrictions, but window.location is fair game.

In order to restrict this behavior, the original page needs to add a rel="noopener" attribute to any link that has target="_blank". However, Firefox does not support that tag, so you should actually use rel="noopener noreferrer" for full coverage. I am not sure why this behavior even exists as the default, but it does. This is an extremely common vulnerability. If you landed on this page, I encourage you to contact the developers of the referring website and alert them of this issue.

You don't have to take my word for it tho. Here's how you can reproduce it on demand

  1. Join any chat (chat links always open a new tab/window)
  2. Paste this URL in and submit: https://dev.to/rly
  3. Click the link in chat
  4. It opens the link in a new tab/window and your chat window is redirected to https://dev.to/phishing

Looks like an easy fix (SO links already add rel="nofollow" for SEO purposes) but this needs fixing yesterday. Hat tip to Kyll for noting it does that.

  • For me it redirects only when clicked from transcript, not when I'm actually in the room. (tested here) – Shadow The Curly Braced Wizard Oct 20 '16 at 12:41
  • @ShadowWizard Interesting. Was the opposite for me. It's starred in SOCVR and clicking the star link did it for me but not the transcript. Am using FF 49.0.1 – Machavity Oct 20 '16 at 12:43
  • Weird indeed. The chat link HTML source contains "noreferrer", while transcript does not, probably in other chat servers it's also different and not consistent. – Shadow The Curly Braced Wizard Oct 20 '16 at 12:44
  • 9
    This is a security vulnerability. You should not report this on Meta, ever. Use the contact form and choose 'Other', including the words Security Vulnerability. Reference. You should delete this post. – ArtOfCode Oct 20 '16 at 13:43
  • 3
    What I really want to know is, why the bloody hell do chat links open in new tabs when SE vehemently refuses to open all links in a new window when NOT in chat? What is this, anarchy? – Won't Oct 20 '16 at 13:52
  • 3
    @Won't It's not anarchy, it's chat having a rebellion. – ArtOfCode Oct 20 '16 at 13:54
  • 1
    @Won't 100% of my links network-wide open in a new tab when I MMB-click – TylerH Oct 20 '16 at 14:01
  • @TylerH the problem seems to be specific to target="_blank" links; I don't think it impacts MMB-click/ctrl-click/etc - you can test with the link above, though – Marc Gravell Oct 20 '16 at 15:16
  • @Won't - somehow related, why chat does one-boxing in the first place for content that could be compromised (even if the actual likelihood of that happening is very low)? – SPArchaeologist Oct 20 '16 at 15:49
18

A change has been deployed that ensures the transcript (and other code that uses the particular code-path) adds the correct hints, and the hints have been extended to use all of them (although I am informed that noreferrer by itself would work)

  • Thanks for the fast fix! – Machavity Oct 20 '16 at 14:12
  • It's not completely fixed yet; would you like me to explain here or somewhere more private like the "contact us" form? – NobodyNada Oct 21 '16 at 23:58
  • @Nobody feel free to ping me at marc@stackoverflow.com – Marc Gravell Oct 23 '16 at 12:20
0

That's pretty alarming.

I noticed this only works when you click these links from the transcript or from the side bar, but not when clicking it directly from live chat.

Nonetheless, this should be fixed ASAP, as it allows some pretty serious griefing of chat users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .