Re: Link Injection Redirection Attacks - Exploiting Google Chrome Design Flaw

[Michal Zalewski <lcamtuf () coredump cx>]

Aditya,

> Video: http://www.secniche.org/videos/google_chrome_link_inj.html

You might find it informative to review the section of BSH on URL parsing:
http://code.google.com/p/browsersec/wiki/Part1#Uniform_Resource_Locators

There are many known quirks related to URL parsing; the practice of
certain browsers to tokenize the authority section using the rightmost
@ sign, in particular, is documented there. Three other spectacular
examples include:

http://example.com;.coredump.cx/ - MSIE will take you somewhere else
than most other browsers would
http://example.com\@coredump.cx/ - means one thing to most browsers,
something else to Firefox
https:example.com - absolute to Firefox (while http:example.com is a
relative link in that same browser)

In essence, any site that accepts, but does not normalize and rewrite
relative / not well formed URLs, and hopes to achieve any degree of
control over the destination of that link, is bound to fail. The
particular example in your video seems to be a clear case of
insufficient validation, and not a browser bug.

It is also unfortunate that URL parsing is deceptively difficult for
humans, but that's the way it is; address bar host name highlighting
and auto-hiding of credentials is the only sensible approach I can
think of; crippling URL syntax, on the other hand, seems heavy-handed.

/mz