Safari 7.0.4 may cause most XSS defense mechanisms to be bypassed (conditional)

Safari 7.0.4 may cause most XSS defense mechanisms to be bypassed (conditional)

After many times, I feel that there is no room for further improvement.
There is also a safari8, first submit this to see the depth

For XSS defense of URL context, many manufacturers will choose to check the characters starting with the URL, for example, whether the first seven characters are "http: //" or the first eight characters are "https: //". From the effect, this method is still very effective.

However, due to the design defect of safari, when the function "allow JavaScript in the Smart Bar" is enabled (I usually enable it because it is easier for me to perform some tests ), this will cause the URL context protection mechanism to be bypassed.
 

Taking mail.qq.com as an example, we will write an email to the victim and fill in the following content:


 

<a href="http://javascript：%0c//mail.qq.com/cgi-bin/frame_html?sid=ajetBhzNxRO3GUAT&r=588c3348231f8ab20df088c03c0a5284'%0aalert(document.domain)">click me</a>

As described above, mail.qq.com does not filter this URL because the URL starts with http. When the victim receives an email and clicks Anchor, we can see the following picture:


 

Javascript is not executed immediately. The first thing that comes to mind here is "I know that protocol is hidden ". It should be like that, but our "http: //" is actually dropped by strip.



Let's try to press enter in the address bar:


 

We can see that JS is executed under mail.qq.com. This is impossible for other browsers.



If you are an impatient user and look at the blank page, you may want to press enter in the address bar to try to reload the page. At this time, you may have suffered a cross-site scripting attack.