bugtraq - Re: Firefox focus stealing vulnerability (possibly other browsers)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:  Mon, 12 Feb 2007 01:11:00 +0100
From: Claus Färber <GMANE@...rber.muc.de>
To: bugtraq@...urityfocus.com
Cc: full-disclosure@...ts.grok.org.uk
Subject:  Re: Firefox focus stealing vulnerability   (possibly other browsers)

Michal Zalewski schrieb:
> This probably explains why the core of the problem wasn't fixed for
> Firefox: reports were repeatedly reduced to an issue with hiding file
> input fields by manipulating opacity or visibility (in my example, I
> placed the box off-screen to the left, at negative absolute coords,
> instead). A proper solution would be to restrict the ability for scripts
> to manipulate focus and read contents of file input fields, instead.

A proper solution would be to keep a list of files explicitly selected 
by the user and only allow uploads of files in this list. Then even if a 
script can manipulate the field, the browser won't upload files that 
have not been selected by the user.

Claus