# OSX slack:// protocol handler javascript injection

Slack macOS app's slack:// URL handler passed unsanitized input into a JS eval, letting a crafted link run arbitrary JavaScript and post messages as the user.

- Payout: hidden
- Severity: high
- Program: Slack
- Found by: computerality
- Disclosed: 2016-06-24
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/79348
- Library page: https://bugbountylibrary.com/r/h1%3A79348
- Tags: area:os domain:desktop impact:integrity kind:bounty platform:hackerone sev:high technique:source-review vuln:xss

**Target:** macOS Slack desktop app slack:// protocol handler
**Root cause:** The URL argument is interpolated into the format string "TSSSB.handleDeepLink('%s');" and evaluated via stringByEvaluatingJavaScriptFromString; stringByAddingPercentEscapesUsingEncoding leaves the single quote unescaped, allowing breakout from the string literal.
**Steps:**
1. Craft a slack:// link whose `a` parameter closes the handleDeepLink string with `');`
2. Append `eval(atob('<base64 JS>'))` to run arbitrary code without spaces
3. Terminate with `String('` to keep the JS syntactically valid
4. Deliver via `<a href="slack://test?team=1&a=');eval(atob('...'));String('">` and have the victim click it
5. Payload runs in the client app context and posts a message to the general channel
**How found:** Researcher examined the new slack:// protocol handler in Slack 1.1, read the Objective-C handler -[SLAppDelegate handleURLEvent:withReplyEvent:], noticed input was interpolated into a JS format string and only escaped with stringByAddingPercentEscapesUsingEncoding, which leaves single quotes intact.
**Exploitation:** Victim clicks a malicious slack:// link on a website or email; the app evaluates the injected JavaScript in its own context, allowing actions like TSSSB.sendMsgFromUser to post messages as the user. Invalid team id still shows a popup but the injected JS executes.
**Insight:** When a native app bridges URLs into a JS eval, check which characters the chosen escaping function actually escapes — percent-escape helpers commonly leave quotes untouched, enabling string-literal breakout.