Full Disclosure mailing list archives
Re: Firefox bookmark cross-domain surfing vulnerability
From: Michal Zalewski <lcamtuf () dione ids pl>
Date: Thu, 22 Feb 2007 01:50:27 +0100 (CET)
On Thu, 22 Feb 2007, pdp (architect) wrote:
michal, is that a feature or a bug? maybe it is not obivous to me what you are doing but it i feel that it is almost like asking the user to bookmark a bookmarklet.
Bookmarklets should be bookmarkable only manually, with user knowledge and consent (that is, you need to copy-and-paste the URL, etc). This seems to be the case for javascript: URLs. Here, the situation is different: the user can, and quite likely will, unknowingly bookmark a script while attempting to bookmark a regular page via Ctrl-D + <return>. He doesn't expect or want this code to later run in the context of his start page or any other resource (principle of least astonishment, etc, etc). Cheers, /mz _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Firefox bookmark cross-domain surfing vulnerability Michal Zalewski (Feb 21)
- Re: Firefox bookmark cross-domain surfing vulnerability Tyop? (Feb 21)
- Re: Firefox bookmark cross-domain surfing vulnerability pdp (architect) (Feb 21)
- Re: Firefox bookmark cross-domain surfing vulnerability Michal Zalewski (Feb 21)
- Re: Firefox bookmark cross-domain surfing vulnerability pdp (architect) (Feb 22)
- Re: Firefox bookmark cross-domain surfing vulnerability Michal Zalewski (Feb 22)
- Re: Firefox bookmark cross-domain surfing vulnerability pdp (architect) (Feb 22)
- Re: Firefox bookmark cross-domain surfing vulnerability Daniel Veditz (Feb 22)
- Re: Firefox bookmark cross-domain surfing vulnerability Michal Zalewski (Feb 21)
- <Possible follow-ups>
- Re: Firefox bookmark cross-domain surfing vulnerability v3dt3n (Feb 21)