lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.LNX.4.58.0702220146180.6282@dione>
Date: Thu, 22 Feb 2007 01:50:27 +0100 (CET)
From: Michal Zalewski <lcamtuf@...ne.ids.pl>
To: "pdp (architect)" <pdp.gnucitizen@...glemail.com>
Cc: bugtraq@...urityfocus.com, security@...illa.org,
	full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Firefox bookmark cross-domain surfing
 vulnerability

On Thu, 22 Feb 2007, pdp (architect) wrote:

> michal, is that a feature or a bug? maybe it is not obivous to me what
> you are doing but it i feel that it is almost like asking the user to
> bookmark a bookmarklet.

Bookmarklets should be bookmarkable only manually, with user knowledge and
consent (that is, you need to copy-and-paste the URL, etc). This seems to
be the case for javascript: URLs.

Here, the situation is different: the user can, and quite likely will,
unknowingly bookmark a script while attempting to bookmark a regular page
via Ctrl-D + <return>. He doesn't expect or want this code to later run in
the context of his start page or any other resource (principle of least
astonishment, etc, etc).

Cheers,
/mz

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ