21

So I learned something rather surprising today and it's pretty scary. I'm actually stunned neither Chrome/Google, nor Mozilla, have plugged it. First, the logistics of how I ran across this

  1. I linked to a page in chat (I want you to read this first so the link is at the end). Pretty benign site
  2. Someone in chat clicked the link later.
  3. That page then hijacked the chat window and redirected it

Now, what's cool is this site is trying to raise visibility of a pretty serious problem with JavaScript. I'd not heard of this before and it's quite the gaping security hole. As in this could do bad things right now.

When a website uses target="_blank" on their links in order to open a new tab or window, that website gives the new page access to the existing window through the window.opener API, allowing it a few permissions. Some of these permissions are automatically negated by cross-domain restrictions, but window.location is fair game.

In order to restrict this behavior, the original page needs to add a rel="noopener" attribute to any link that has target="_blank". However, Firefox does not support that tag, so you should actually use rel="noopener noreferrer" for full coverage. I am not sure why this behavior even exists as the default, but it does. This is an extremely common vulnerability. If you landed on this page, I encourage you to contact the developers of the referring website and alert them of this issue.

You don't have to take my word for it tho. Here's how you can reproduce it on demand

  1. Join any chat (chat links always open a new tab/window)
  2. Paste this URL in and submit: https://dev.to/rly
  3. Click the link in chat
  4. It opens the link in a new tab/window and your chat window is redirected to https://dev.to/phishing

Looks like an easy fix (SO links already add rel="nofollow" for SEO purposes) but this needs fixing yesterday. Hat tip to Kyll for noting it does that.

Improve this question
9
  • For me it redirects only when clicked from transcript, not when I'm actually in the room. (tested here)
    – Shadow Wizard Is Sad And Angry
    Oct 20, 2016 at 12:41
  • @ShadowWizard Interesting. Was the opposite for me. It's starred in SOCVR and clicking the star link did it for me but not the transcript. Am using FF 49.0.1
    – Machavity
    Oct 20, 2016 at 12:43
  • Weird indeed. The chat link HTML source contains "noreferrer", while transcript does not, probably in other chat servers it's also different and not consistent.
    – Shadow Wizard Is Sad And Angry
    Oct 20, 2016 at 12:44
  • 10
    This is a security vulnerability. You should not report this on Meta, ever. Use the contact form and choose 'Other', including the words Security Vulnerability. Reference. You should delete this post.
    – ArtOfCode
    Oct 20, 2016 at 13:43
  • 3
    What I really want to know is, why the bloody hell do chat links open in new tabs when SE vehemently refuses to open all links in a new window when NOT in chat? What is this, anarchy?
    – user1228
    Oct 20, 2016 at 13:52
  • 3
    @Won't It's not anarchy, it's chat having a rebellion.
    – ArtOfCode
    Oct 20, 2016 at 13:54
  • 1
    @Won't 100% of my links network-wide open in a new tab when I MMB-click
    – TylerH
    Oct 20, 2016 at 14:01
  • @TylerH the problem seems to be specific to target="_blank" links; I don't think it impacts MMB-click/ctrl-click/etc - you can test with the link above, though
    – Marc Gravell
    Oct 20, 2016 at 15:16
  • @Won't - somehow related, why chat does one-boxing in the first place for content that could be compromised (even if the actual likelihood of that happening is very low)?
    – SPArcheon
    Oct 20, 2016 at 15:49

2 Answers 2

Reset to default
19

A change has been deployed that ensures the transcript (and other code that uses the particular code-path) adds the correct hints, and the hints have been extended to use all of them (although I am informed that noreferrer by itself would work)

Improve this answer
2
  • It's not completely fixed yet; would you like me to explain here or somewhere more private like the "contact us" form?
    – NobodyNada
    Oct 21, 2016 at 23:58
  • @Nobody feel free to ping me at [email protected]
    – Marc Gravell
    Oct 23, 2016 at 12:20
1

That's pretty alarming.

I noticed this only works when you click these links from the transcript or from the side bar, but not when clicking it directly from live chat.

Nonetheless, this should be fixed ASAP, as it allows some pretty serious griefing of chat users.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .