Mozilla this week announced plans to boost the Cross-Site-Scripting (XSS) protections in Firefox by treating data URLs as unique origin.

The use of a data URL scheme allows web developers to inline small files directly into HTML or CSS documents, which also results in faster page load times. Because of this mechanism, the browser doesn’t have to perform a large number of HTTP requests to load external resources, as they are already in the page.However, the same technique allows cybercriminals to craft attack pages and steal usernames, passwords, and other confidential information from unsuspecting users.

By embedding the entire attack code within the data URL, miscreants can launch attacks without having to actually host a full website. The data URL inherits the security context of the embedding element, and this inheritance model opens the door for Cross-Site-Scripting (XSS) attacks.

To prevent such attacks, Firefox 57 will treat data URLs as unique origins and will no longer inherit the origin of the settings object responsible for the navigation. Thus, data URLs loaded inside an iframe will no longer be same-origin with their parent document.

“Starting with Firefox 57, data URLs loaded inside an iframe will be considered cross-origin. Not only will that behavior mitigate the risk of XSS, it will also make Firefox standards compliant and consistent with the behavior of other browsers,” Mozilla notes in a blog post.

However, the company also explains that data URLs that do not end up creating a scripting environment will continue to be considered same-origin. Data URLs in img elements will be treated as such, Mozilla says.Because of the new security setting, Firefox 57 will block attempts to reach content from a different origin, such as when a script within a data URL iframe attempts to access objects from the embedding context. In Firefox version 56 and older, this was possible because the data URLs inherited the security context.

The security enhancement was announced the same week Mozilla revealed plans to completely remove support for Windows XP and Vista from Firefox starting June 2018. A couple of months ago, the company made the Adobe Flash plugin click-to-activate by default, thus further improving the security of its users.

Source : securityweek.com