6 ms·

Today I learnt you can enter html into the url bar. Paste this into the URL bar: data:text/html,<h1>hello</h1> or try this like the article suggests: da

Today I learnt you can enter html into the url bar. Paste this into the URL bar: data:text/html,<h1>hello</h1> or try this like the article suggests: data:text/html,<html contenteditable>

onion2k 6y ago
Or this; data:text/html,<script>alert('pasting code from the internet in to your address bar should not be encouraged');</script>
- forgotpwd16 6y ago
  Good note. The implications of pasting arbitrarily code in address bar is known as self-XSS which can be used to hijack online accounts.
- kozhevnikov 6y ago
  Encouraged? No, but data urls are heavily sandboxed, e.g. can't even access own cookies.
  - katsura 6y ago
    Although, this is not a data URL per se, but just pasting it in the URL bar allows you to do pretty much anything: javascript:alert(document.cookie)
    - tlamponi 6y ago
      My Firefox here does not allows that. 1. It strips the JavaScript: part away if I just paste it once 2. Even if I re-add it manually, it still does no alert Ergo, a sane browser can be quite sandboxed to avoid the average user to do stupid to easily.
      - myfonj 6y ago
        Yup. javascript: URL (either pasted or typed into URL bar) are long gone as self-xss precaution. The only way you can run javascript: URL is bookmarking it and invoking resulting bookmarklet. And AFAIK there is no way to re-enable it again. You have to start web developers console to rund ad-hoc JavaScript code in pages' context. (I see this as an end of glorious era of "you can do pretty much anything in URL bar".)
- Wowfunhappy 6y ago
  Is this any different than running code from the internet by typing a website into your address bar?
  - thebeefytaco 6y ago
    Well I just quickly tested, and NoScript doesn't seem to block that, whereas it would if it were externally loaded or inline JS on a web page. So that's one difference. Not that the type of person to use NoScript would likely paste obvious javascript into the address bar... Edit: Doesn't look like you can create a valid URL with that format, but it can be launched via pasting in (obviously), a bookmark (which the contents of which could be obfuscated by telling a user to drag an image to the bookmark bar and click it), and can be launched via command line, e.g. start firefox "data:text/html,<script>alert('');</script>"
_trampeltier 6y ago
Sadly it does not work on Firefox Mobile :-(
- jsmith99 6y ago
  https://github.com/mozilla-mobile/fenix/issues/2871 https://github.com/mozilla-mobile/fenix/issues/2871 tracks effectively the same issue, which is that Firefox Android no longer supports bookmarklets.
known 6y ago
javascript:location.href='https://archive.vn/'+document.location.href; https://archive.vn/'+document.location.href; bookmark to access archive.today instead of addon And https://viewdns.info/ping/?domain=archive.today https://viewdns.info/ping/?domain=archive.today to get the fastest IP and include it in /etc/hosts
shakna 6y ago
To take this to a fun little limit, I tried to turn it into a self-saving form. Unfortunately, I hit problems with the History API being forbidden, replacing the URL seemed to only reload the page and not change it and so on... But I did eventually get something that is quite useable, which you should obviously not copy and past blindly: data:text/html,<div id="c" contenteditable></div><a id="p"></a><script>var el=document.getElementById('c');el.addEventListener('input',function(){document.getElementById('p').textContent='Copy me';document.getElementById('p').href="data:text/html,"+this.parentElement.innerHTML;},false);</script> And to expand that awful payload, it's basically the very simple: <div id="c" contenteditable></div> <a id="p"></a> <script> var el = document.getElementById('c'); el.addEventListener('input', function() { document.getElementById('p').textContent = 'Copy me'; document.getElementById('p').href = "data:text/html," + this.parentElement.innerHTML; }, false); </script> The idea being, you can _almost_ have a self-saving editable page. Because it was fun to make.

Today I learnt you can enter html into the url bar. Paste this into the URL bar: data:text/html,<h1>hello</h1> or try this like the article suggests: data:text/html,<html contenteditable>

onion2k 6y ago

Or this; data:text/html,<script>alert('pasting code from the internet in to your address bar should not be encouraged');</script>

forgotpwd16 6y ago
Good note. The implications of pasting arbitrarily code in address bar is known as self-XSS which can be used to hijack online accounts.
kozhevnikov 6y ago
Encouraged? No, but data urls are heavily sandboxed, e.g. can't even access own cookies.
- katsura 6y ago
  Although, this is not a data URL per se, but just pasting it in the URL bar allows you to do pretty much anything: javascript:alert(document.cookie)
  - tlamponi 6y ago
    My Firefox here does not allows that. 1. It strips the JavaScript: part away if I just paste it once 2. Even if I re-add it manually, it still does no alert Ergo, a sane browser can be quite sandboxed to avoid the average user to do stupid to easily.
    - myfonj 6y ago
      Yup. javascript: URL (either pasted or typed into URL bar) are long gone as self-xss precaution. The only way you can run javascript: URL is bookmarking it and invoking resulting bookmarklet. And AFAIK there is no way to re-enable it again. You have to start web developers console to rund ad-hoc JavaScript code in pages' context. (I see this as an end of glorious era of "you can do pretty much anything in URL bar".)
Wowfunhappy 6y ago
Is this any different than running code from the internet by typing a website into your address bar?
- thebeefytaco 6y ago
  Well I just quickly tested, and NoScript doesn't seem to block that, whereas it would if it were externally loaded or inline JS on a web page. So that's one difference. Not that the type of person to use NoScript would likely paste obvious javascript into the address bar... Edit: Doesn't look like you can create a valid URL with that format, but it can be launched via pasting in (obviously), a bookmark (which the contents of which could be obfuscated by telling a user to drag an image to the bookmark bar and click it), and can be launched via command line, e.g. start firefox "data:text/html,<script>alert('');</script>"

_trampeltier 6y ago

Sadly it does not work on Firefox Mobile :-(

jsmith99 6y ago
https://github.com/mozilla-mobile/fenix/issues/2871 https://github.com/mozilla-mobile/fenix/issues/2871 tracks effectively the same issue, which is that Firefox Android no longer supports bookmarklets.

known 6y ago

javascript:location.href='https://archive.vn/'+document.location.href; https://archive.vn/'+document.location.href; bookmark to access archive.today instead of addon And https://viewdns.info/ping/?domain=archive.today https://viewdns.info/ping/?domain=archive.today to get the fastest IP and include it in /etc/hosts

shakna 6y ago

To take this to a fun little limit, I tried to turn it into a self-saving form. Unfortunately, I hit problems with the History API being forbidden, replacing the URL seemed to only reload the page and not change it and so on... But I did eventually get something that is quite useable, which you should obviously not copy and past blindly: data:text/html,<div id="c" contenteditable></div><a id="p"></a><script>var el=document.getElementById('c');el.addEventListener('input',function(){document.getElementById('p').textContent='Copy me';document.getElementById('p').href="data:text/html,"+this.parentElement.innerHTML;},false);</script> And to expand that awful payload, it's basically the very simple: <div id="c" contenteditable></div> <a id="p"></a> <script> var el = document.getElementById('c'); el.addEventListener('input', function() { document.getElementById('p').textContent = 'Copy me'; document.getElementById('p').href = "data:text/html," + this.parentElement.innerHTML; }, false); </script> The idea being, you can _almost_ have a self-saving editable page. Because it was fun to make.