Problem/Motivation

ping attributes on links make CSRF attacks against POST routes easier.

If you have a POST route that is not correctly protected against CSRF, an attacker could insert this HTML:

<a href="" ping="/entity/42/delete">Click me</a>

If another user with the correct permissions clicks the link, a POST request is silently sent (with cookies) to this URL.
(Firefox does not support this attribute.)

The correct solution is of course to protect the route with a CSRF token, but we should not make this easier for attackers.
The attribute is allowed by Xss::filter() so various contrib modules that are using this method to sanitize user input could be used to insert it in the page.

Another reason to remove it would privacy reasons (it allows tracking user clicks).

Steps to reproduce

Xss::filter('<a href="" ping="/entity/42/delete">Click me</a>')

Proposed resolution

Add it to the list of attributes removed by Xss::attributes().

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Issue fork drupal-3636218

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

prudloff created an issue. See original summary.

deruina made their first commit to this issue’s fork.

deruina opened merge request !17759

deruina’s picture

deruina commented
Status: Active » Needs review

Added "ping" to the attributes Xss::attributes() always strips, next to style and srcdoc, plus a test case in XssTest::providerTestFilterXssNotNormalized(). The new case fails without the change and the Utility unit tests pass with it.