ERR_BLOCKED_BY_XSS_AUDITOR when downloading file using selenium

问题

I'm trying to download a file using selenium by simulating click on a download button but Chrome reports ERR_BLOCKED_BY_XSS_AUDITOR. If I use the "--disable-xss-auditor" argument to bypass, the page would be reloaded and nothing get downloaded. What seems strange to me is that when I actually download the file with my mouse in a Chrome session that's even controlled by selenium, the file downloads well.

Please help me understand what xss auditor does? Why can't I download the file with selenium?

BTW, I'm using python if it matters.

Thanks

回答1:

X-XSS-Protection

The HTTP X-XSS-Protection response header is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. Although these protections are largely unnecessary in modern browsers when sites implement a strong Content-Security-Policy that disables the use of inline JavaScript ('unsafe-inline'), they can still provide protections for users of older web browsers that don't yet support CSP.

Header type               Response header
-----------               ---------------
Forbidden header name     no

Syntax

• X-XSS-Protection: 0: Disables XSS filtering.
• X-XSS-Protection: 1: Enables XSS filtering (usually default in browsers). If a cross-site scripting attack is detected, the browser will sanitize the page (remove the unsafe parts).
• X-XSS-Protection: 1: mode=block Enables XSS filtering. Rather than sanitizing the page, the browser will prevent rendering of the page if an attack is detected.
• X-XSS-Protection: 1: report= (Chromium only) Enables XSS filtering. If a cross-site scripting attack is detected, the browser will sanitize the page and report the violation. This uses the functionality of the CSP report-uri directive to send a report.

Background

As per Intent to Ship: Changes to the XSS Auditor Chromium team made two changes:

• Change the default behavior to X-XSS-Protection: 1; mode=block, which blocks the page load by navigating to a unique origin when XSS is detected, rather than filtering out specific scripts.
• Deprecate the filter mode, with the intent to remove it completely at some future date.

Implementation Status

XSS Auditor blocks by default: Chrome's XSS Auditor should block pages by default, rather than filtering out suspected reflected XSS. Moreover, we should remove the filtering option, as breaking specific pieces of page's script has been an XSS vector itself in the past.

As per XSS Auditor: Block by default, remove filtering this issue was discussed and a fix was attempted. Some more discussion happened in False positives with ERR_BLOCKED_BY_XSS_AUDITOR and finally in ERR_BLOCKED_BY_XSS_AUDITOR on bona fide site when posting to a forum Chromium team decided Status: WontFix

Solution

You need to induce WebDriverWait for the desired element to be clickable. Here are some examples of the WebDriverWait implementation:

• Java:

  new WebDriverWait(driver, 20).until(ExpectedConditions.elementToBeClickable(By.linkText("text_within_the _link"))).click(); 
  

• Python:

  WebDriverWait(driver, 20).until(EC.element_to_be_clickable((By.LINK_TEXT, "text_within_the _link"))).click()
  

• C#:

  new WebDriverWait(driver, TimeSpan.FromSeconds(10)).Until(ExpectedConditions.ElementToBeClickable(By.LinkText("text_within_the _link"))).Click();
  

Reference

• Event 1046 - Cross-Site Scripting Filter
• The misunderstood X-XSS-Protection

回答2:

I slowed down the clicks (2 clicks needed to download, added a sleep between them) and it works! Have no idea what happened...

回答3:

XSS Auditor is a built-in function of Chrome and Safari which is designed to mitigate Cross-site Scripting (XSS) attacks. It aims to identify if query parameters contain malicious JavaScript and block the response if it believes the payloads were injected into the server response.

XSS is a vulnerability that occurs when the data get (mis)interpreted as code and executed on a victim's browser. The idea is to use a headless browser like Selenium WebDriver, and inject XSS payloads along with functional and user interaction tests

Python don't have anything to do with that, I think that might be the chrome version or something

i have shared the link which will help you understand better.

Chrome: ERR_BLOCKED_BY_XSS_AUDITOR details

来源：https://stackoverflow.com/questions/54210404/err-blocked-by-xss-auditor-when-downloading-file-using-selenium