bugtraq - Re: XSS on Yahoo Mail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 24 Nov 2005 19:28:45 -0000
From: "Jim Ley" <jim@...bering.com>
To: bugtraq@...urityfocus.com
Subject: Re: XSS on Yahoo Mail

"Will Wesley" <willwesleyccna@...oo.de> wrote in message 
news:20051124025004.32883.qmail@...26902.mail.ukl.yahoo.com...

>This is not exactly a problem with Yahoo!, but rather
>a problem with the way browsers tend to render HTML
>when forced to deal with broken tags.

So it's a problem with Yahoo, as they allow the email, to write to places on 
the screen that is not part of the email.  I agree this is certainly down to 
the liberalness of the browsers parser, but that doesn't mean yahoo can 
ignore it, it's just a demonstration of how difficult a job it is for people 
who want to accept arbitrary HTML to be secure for their user

Of course there is a pretty simple solution, which is to just use an IFRAME, 
then there's no way the email to escape into the surrounding chrome.

Jim.