BugTraq
Firefox bookmark cross-domain surfing vulnerability Feb 21 2007 11:51PM
Michal Zalewski (lcamtuf dione ids pl) (1 replies)
Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability Feb 22 2007 12:17AM
pdp (architect) (pdp gnucitizen googlemail com) (1 replies)
Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability Feb 22 2007 12:50AM
Michal Zalewski (lcamtuf dione ids pl)
On Thu, 22 Feb 2007, pdp (architect) wrote:

> michal, is that a feature or a bug? maybe it is not obivous to me what
> you are doing but it i feel that it is almost like asking the user to
> bookmark a bookmarklet.

Bookmarklets should be bookmarkable only manually, with user knowledge and
consent (that is, you need to copy-and-paste the URL, etc). This seems to
be the case for javascript: URLs.

Here, the situation is different: the user can, and quite likely will,
unknowingly bookmark a script while attempting to bookmark a regular page
via Ctrl-D + <return>. He doesn't expect or want this code to later run in
the context of his start page or any other resource (principle of least
astonishment, etc, etc).

Cheers,
/mz

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus