GHSA-89vp-x45c-52cq Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

• npm quasar: < 2.32.2 → fixed in 2.32.2

Summary A DOM Clobbering vulnerability exists in Quasar's `openURL()` utility when handling the iOS `SafariViewController` bridge. The vulnerable implementation only checks whether `window.SafariViewController` exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as `` can cause the browser to expose that element as `window.SafariViewController`. When `openURL()` is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in: ``` TypeError: window.SafariViewController.isAvailable is not a function ``` This can cause client-side denial of service and break navigation-related workflows in Quasar applications. Details Quasar provides the `openURL()` utility to open external URLs. On iOS platforms, this utility supports integration with the native `SafariViewController` bridge. The vulnerable code is located in: ``` ui/src/utils/open-url/open-url.js ```` The affected logic is: ```javascript if (Platform.is.ios && window.SafariViewController !== void 0) { window.SafariViewController.isAvailable(available => { if (available) { window.SafariViewController.show({ url }, noop, reject) } }) } ```` The issue is that Quasar only verifies that `window.SafariViewController` is not `undefined`. It does not verify whether the value is the expected native bridge object or whether required methods such as `isAvailable()` and `show()` are valid functions. Modern browsers expose elements with specific `id` or `name` attributes as properties of the global `window` object. Therefore, attacker-controlled HTML such as: ```html ``` can cause: ```javascript window.SafariViewController ``` to resolve to an `HTMLAnchorElement` instead of the expected native bridge object. When Quasar later executes: ```javascript window.SafariViewController.isAvailable(...) ``` the DOM element is incorrectly treated as the bridge object, causing: ``` TypeError: window.SafariViewController.isAvailable is not a function ``` The root cause is insufficient validation of browser-controlled global properties before using them as trusted native bridge objects. The vulnerability was verified through the Quasar `QEditor` rendering path. When attacker-controlled HTML content is rendered into the DOM and creates the `SafariViewController` named element, subsequent calls to `openURL()` fail. Additional component-level affected paths were identified in `QSelect` and `QChatMessage` when applications enable HTML rendering features and provide attacker-controlled content. These paths require specific application configurations and were not used as the primary end-to-end reproduction. PoC Steps to reproduce 1. Render attacker-controlled HTML content through a Quasar HTML rendering component such as `QEditor`. 2. Insert the following payload: ```html SafariViewController ```` 3. Verify that the browser exposes the element as a global property: ```javascript window.SafariViewController ``` The value resolves to the injected DOM element instead of the expected native bridge object. 4. Trigger a normal workflow that invokes: ```javascript openURL('https://example.com') ``` 5. Observe the browser console output: ``` TypeError: window.SafariViewController.isAvailable is not a function ``` The URL opening workflow fails because Quasar attempts to invoke native bridge methods on the DOM element. The same underlying issue can also affect other HTML rendering paths such as `QSelect` and `QChatMessage` when attacker-controlled HTML is rendered and the application later calls `openURL()`. Impact This vulnerability is a client-side DOM Clobbering and type confusion issue affecting Quasar applications that use the iOS `SafariViewController` integration. An attacker who can control HTML content rendered into the application DOM may cause Quasar's `openURL()` functionality to fail by replacing the expected native bridge object with a DOM element through browser named property resolution. Potentially affected workflows include external URL navigation, OAuth/login redirects, help or documentation links, payment flows, third-party service redirects, and other application actions that rely on URL opening functionality. The confirmed impact is client-side denial of service and navigation or workflow disruption. When the vulnerable condition is triggered, Quasar throws an exception while attempting to invoke methods on the clobbered `SafariViewController` object, preventing the expected URL opening behavior.