url(...) style injections in cosmetic filters

[antonok-edm]

Prerequisites

• I verified that this is not a filter issue
  • Filter issues MUST be reported at filter issue tracker
• This is not a support issue or a question
  • Support issues and questions are handled at /r/uBlockOrigin
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue
  • Your issue may already be reported.
• I tried to reproduce the issue when...
  • uBlock Origin is the only extension
  • uBlock Origin with default lists/settings
  • using a new, unmodified browser profile
• I am running the latest version of uBlock Origin
• I checked the documentation to understand that the issue I report is not a normal behavior

Description

There is a regex in the cosmetic filtering code to invalidate filter rules that contain url(. However, it's possible to bypass this check by using escape codes for any of those characters, e.g. \75 rl(.

A specific URL where the issue occurs

This can be applied to any URL, fetching a resource from any other URL. As a specific example, if the following rule is inserted into the filter list:

example.com##*:style(background: \75 rl("https://raw.githubusercontent.com/gorhill/uBlock/master/doc/img/icon38@2x.png"))

Visiting https://example.com will display the uBlock Origin logo all over the page.

Steps to Reproduce

1. Open the "My filters" tab in the uBlock Origin dashboard
2. Insert the following rule into the large input area on a new line:

example.com##*:style(background: \75 rl("https://raw.githubusercontent.com/gorhill/uBlock/master/doc/img/icon38@2x.png"))

3. Click "Apply changes"
4. Navigate to https://example.com in a new tab

Expected behavior:

The rule should be treated the same as if it did not use an escape sequence, i.e. ignored.

Actual behavior:

The rule is applied to the page, causing an additional network request to fetch the image resource from a 3rd party (in this case, Github).

Your environment

• uBlock Origin version: v1.20.0
• Browser Name and version: Confirmed on Brave 0.66.99 Chromium: 75.0.3770.100, Firefox Nightly 69.0a1
• Operating System and version: Arch Linux

More info

This particular line contains the existing, insufficient check for the presence of url(: https://github.com/gorhill/uBlock/blob/8d8336ffae6ddfa44faaea77cbe5d476109fd007/src/js/static-ext-filtering.js#L668

[gorhill]

Thanks for the report.

For your interest @ameshkov, Adguard also suffers this issue. On my side I just outright banned the use of \ in CSS styles.

[ameshkov]

@gorhill huh, yep, thanks for mentioning it!