# Google.com – Mobile Feedback URL Redirect Regex/Validation Flaw

Google mobile feedback page parsed redirect URL with regex; a period before the colon made the protocol capture group empty, bypassing the http/https check and enabling javascript: redirect.

- Payout: $500
- Severity: medium
- Program: Google
- Credited: Brett Buerhaus
- Disclosed: 2015-02-03
- Write-up quality: 7/10
- Original: https://buer.haus/2015/02/03/google-com-mobile-feedback-url-redirect-regexvalidation-flaw/
- Library page: https://bugbountylibrary.com/r/blog%3Abuer-haus-2015-02-03-google-com-mobile-feedback-url-redirect-regexvalidation-flaw
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium technique:js-analysis technique:source-review vuln:open-redirect vuln:xss

**Target:** google.com/tools/feedback/mobile_feedback redirect handler (mobile_submitter__en.js)
**Root cause:** URL parsed by a Closure Library regex where the protocol capture group is optional; inserting a period before the colon makes group 1 undefined while the whole string lands in group 5, so the protocol check sees an empty value and treats it as a relative path.
**Steps:**
1. Load `https://www.google.com/tools/feedback/mobile_feedback?hl=en&url=http://www.apple.com/&redirect=true&authuser=0&pi=17&hl=en` to confirm redirect flow.
2. Beautify `mobile_submitter__en.js` and set breakpoints to observe regex parsing and the `if ("http"==a||"https"==a||""==a)` check before `window.location.href = this.d`.
3. Craft payload `?url=javascript.:alert(1);&redirect=true&authuser=0&pi=17&hl=en`.
4. Regex yields group 1 undefined and group 5 = `javascript.:alert(1);`, passing the empty-protocol branch.
5. Browser redirects to `javascript.:alert(1);`.
**How found:** Hypothesis that mobile versions of Google services are less scrutinized; found a feedback page passing a `url` request variable, then beautified obfuscated JS and used Firebug breakpoints to trace regex parsing and the protocol whitelist before redirect.
**Exploitation:** Attacker crafts a mobile_feedback link with a `javascript.:` URL; the regex misparse makes the protocol check pass as blank, and window.location.href navigates to the javascript: URI, executing script in google.com origin. Author could not get a browser to ignore the period, but Google noted an active browser vulnerability that made it exploitable.
**Insight:** When a URL is validated by regex but the redirect uses the original unparsed string, look for optional capture groups: a delimiter like `.` or `#` before the scheme colon can shift the whole URL into a later group, leaving the protocol group empty and satisfying a 'blank means relative path' branch.