[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <eqobal$o2e$1@sea.gmane.org>
Date: Mon, 12 Feb 2007 01:11:00 +0100
From: Claus Färber <GMANE@...rber.muc.de>
To: bugtraq@...urityfocus.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Firefox focus stealing vulnerability (possibly other browsers)
Michal Zalewski schrieb:
> This probably explains why the core of the problem wasn't fixed for
> Firefox: reports were repeatedly reduced to an issue with hiding file
> input fields by manipulating opacity or visibility (in my example, I
> placed the box off-screen to the left, at negative absolute coords,
> instead). A proper solution would be to restrict the ability for scripts
> to manipulate focus and read contents of file input fields, instead.
A proper solution would be to keep a list of files explicitly selected
by the user and only allow uploads of files in this list. Then even if a
script can manipulate the field, the browser won't upload files that
have not been selected by the user.
Claus
Powered by blists - more mailing lists