Skip to content

Consider recording the "duplicate-attribute" error state. #3257

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
mikewest opened this issue Nov 27, 2017 · 7 comments
Open

Consider recording the "duplicate-attribute" error state. #3257

mikewest opened this issue Nov 27, 2017 · 7 comments
Labels
security/privacy There are security or privacy implications topic: parser

Comments

@mikewest
Copy link
Member

CSP attempts to defend against some kinds of dangling-markup attacks by preventing the execution of scripts that include "" in an attribute name or value. Discarding attributes during parsing makes it possible to trivially work around this defense, as described in https://crbug.com/740615. As dropping repeated attributes is also the root cause of the dangling-markup risk in the first place, it might be reasonable to dig into it a little more deeply to see if something more fundamental can be done.

One idea we (briefly) discussed at TPAC is to prevent nonced script execution for