Hacker News Reader

Comment by tomglynch | Hacker News Reader

Today I learnt you can enter html into the url bar.

Paste this into the URL bar:

  data:text/html,<h1>hello</h1>

or try this like the article suggests:

  data:text/html,<html contenteditable>

View on HN

Or this;

    data:text/html,<script>alert('pasting code from the internet in to your address bar should not be encouraged');</script>

Encouraged? No, but data urls are heavily sandboxed, e.g. can't even access own cookies.

Although, this is not a data URL per se, but just pasting it in the URL bar allows you to do pretty much anything:

    javascript:alert(document.cookie)

My Firefox here does not allows that.

1. It strips the JavaScript: part away if I just paste it once

2. Even if I re-add it manually, it still does no alert

Ergo, a sane browser can be quite sandboxed to avoid the average user to do stupid to easily.

Yup. javascript: URL (either pasted or typed into URL bar) are long gone as self-xss precaution. The only way you can run javascript: URL is bookmarking it and invoking resulting bookmarklet. And AFAIK there is no way to re-enable it again. You have to start web developers console to rund ad-hoc JavaScript code in pages' context. (I see this as an end of glorious era of "you can do pretty much anything in URL bar".)

Is this any different than running code from the internet by typing a website into your address bar?

Well I just quickly tested, and NoScript doesn't seem to block that, whereas it would if it were externally loaded or inline JS on a web page.

So that's one difference. Not that the type of person to use NoScript would likely paste obvious javascript into the address bar...

Edit: Doesn't look like you can create a valid URL with that format, but it can be launched via pasting in (obviously), a bookmark (which the contents of which could be obfuscated by telling a user to drag an image to the bookmark bar and click it), and can be launched via command line, e.g.

  start firefox "data:text/html,<script>alert('');</script>"

Good note. The implications of pasting arbitrarily code in address bar is known as self-XSS which can be used to hijack online accounts.

To take this to a fun little limit, I tried to turn it into a self-saving form. Unfortunately, I hit problems with the History API being forbidden, replacing the URL seemed to only reload the page and not change it and so on... But I did eventually get something that is quite useable, which you should obviously not copy and past blindly:

    data:text/html,<div id="c" contenteditable></div><a id="p"></a><script>var el=document.getElementById('c');el.addEventListener('input',function(){document.getElementById('p').textContent='Copy me';document.getElementById('p').href="data:text/html,"+this.parentElement.innerHTML;},false);</script>

And to expand that awful payload, it's basically the very simple:

    <div id="c" contenteditable></div>
    <a id="p"></a>
    <script>
    var el = document.getElementById('c');
    el.addEventListener('input', function() {
        document.getElementById('p').textContent = 'Copy me';
        document.getElementById('p').href = "data:text/html," + this.parentElement.innerHTML;
    }, false);
    </script>

The idea being, you can _almost_ have a self-saving editable page. Because it was fun to make.

javascript:location.href='https://archive.vn/'+document.location.href;

bookmark to access archive.today instead of addon

And https://viewdns.info/ping/?domain=archive.today to get the fastest IP and include it in /etc/hosts

Sadly it does not work on Firefox Mobile :-(

https://github.com/mozilla-mobile/fenix/issues/2871 tracks effectively the same issue, which is that Firefox Android no longer supports bookmarklets.

Reply on news.ycombinator.com