the-web-application-hackers-handbook

Chapter 13 n Attacking Users: Other Techniques 523
E4X
In the recent past, E4X has been a fast-evolving area, with browser behavior
being frequently updated in response to exploitable conditions that have been
identified in numerous real-world applications.
E4X is an extension to ECMAScript languages (including JavaScript) that adds
native support for the XML language. At the present time, it is implemented in
current versions of the Firefox browser. Although it has since been fixed, a classic
example of cross-domain data capture can be found in Firefox’s handling of E4X.
As well as allowing direct usage of XML syntax within JavaScript, E4X allows
nested calls to JavaScript from within XML:
var foo={prompt(‘Please enter the value of bar.’)};
These features of E4X have two significant consequences for cross-domain
data-capture attacks:
n A piece of well-formed XML markup is treated as a value that is not
assigned to any variable.
n Text nested in a {...} block is executed as JavaScript to initialize the
relevant part of the XML data.
Much well-formed HTML is also well-formed XML, meaning that it can be
consumed as E4X. Furthermore, much HTML includes script code in a {...}
block that contains sensitive data. For example:
...
function setNonce()
{
nonce = ‘222230313740821’;
}
...
...
In earlier versions of Firefox, it was possible to perform a cross-domain script
include of a full HTML response like this and have some of the embedded
JavaScript execute within the attacker’s domain.