Security: JavaScript URL injection allowed in query string parameter and redirection to uBlock origin urls

[hackvertor]

Prerequisites

• I verified that this is not a filter issue (MUST be reported at filter issue tracker)
• This is not a support issue or a question
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue
• The issue is not present after wholly disabling uBlock Origin ("uBO") in the browser
• I checked the documentation to understand that the issue I report is not a normal behavior

I tried to reproduce the issue when...

• uBO is the only extension
• uBO with default lists/settings
• using a new, unmodified browser profile

Description

uBlock origin allows you to redirect to it's Chrome URL from certain sites such as Github. It's also possible to inject a JavaScript URL but CSP inside the extension prevents exploitation. This also works for redirecting to other uBlock locations within the extension.

https://subscribe.adblockplus.org/?location=javascript:alert(1)&title=EasyList

You can redirect to any other URL within the extension too:
https://subscribe.adblockplus.org/?location=dashboard.html%23about.html&title=EasyList

A specific URL where the issue occurs

https:

Steps to Reproduce

1. Visit the following URL https://subscribe.adblockplus.org/?location=javascript:alert(1)&title=EasyList
2. Click the javascript URL link.
3. You should get a CSP violation.

Expected behavior

JavaScript URLs should not be allowed.

Actual behavior

JavaScript URL is allowed and a CSP violation occurs.

uBlock Origin version

1.38.6

Browser name and version

Chrome 95.0.4638.69

Operating System and version

MacOS 10.15.7

[gwarser]

gorhill/uBlock@8b8b7da#r59932865

[gorhill]

Related: https://portswigger.net/research/ublock-i-exfiltrate-exploiting-ad-blockers-with-css