[prev in list] [next in list] [prev in thread] [next in thread]
List: kmail-devel
Subject: Re: Possible security problem in KHTML or KMail?
From: Vadim Plessky <lucy-ples () mtu-net ! ru>
Date: 2001-10-11 13:06:20
[Download RAW message or body]
Hi,
On Wednesday 10 October 2001 01:29, Malte Starostik wrote:
| Hi,
|
| Vadim's message:
| Subject: crash on amdzone.com - from ad.doubleclick.net
| From: Vadim Plessky <lucy-ples@mtu-net.ru>
| To: 30266@bugs.kde.org
| Cc: KFM Devel <kfm-devel@master.kde.org>
|
| caused the following error message to appear when I clicked on it in
| KMail. "Unable to run the command specified. The file or directory
| file:/ads1_files/B46014;sZ=468x60;siteid=C296;ord=[timestamp].htm"
Hmm. At a first glance, this just confirms rumors circulating around that
ad.doubleclick.net creates potential threat to security (and collects private
information about web sites' visitors...)
NOTE that content of this IFRAME can have HTML file *with JavaScript*!
And if it's coming from different domain (not domain main page located at),
it can be enabled and exposure potential security threat.
Please consider slightly modifies testcase:
-----------------------------------
<HTML><HEAD>
</HEAD>
<BODY>
<body>
<P>Hello!</P>
<iframe id="fr1" width="200" height="300" src="/etc/passwd">
</iframe>
<SCRIPT language=Javascript>
alert("hello");
el=document.getElementsByTagName("IFRAME").item(0);
// el=document.getElementsByTagName("P").item(0);
alert ( "el="+el);
document.write("<BR> IFRAME id= "+el.id);
document.write("<BR> IFRAME.hasChildNodes() "+el.hasChildNodes());
if ( el.hasChildNodes() )
{
document.write("<BR> childNodes ="+el.childNodes);
document.write("<BR> childNodes.length ="+el.childNodes.length);
a = el.childNodes.item(0);
document.write("<BR> a= "+a);
document.write("<BR> content:");
document.write("<P>"+ a.nodeValue);
}
document.write("<BR> IFRAME.contentDocument "+el.contentDocument());
</SCRIPT>
</BODY>
</HTML>
-----------------------------------
Executing this testcase in Konq, I get:
~ ~ ~ ~ ~ ~
IFRAME id= fr1
IFRAME.hasChildNodes() false
IFRAME.contentDocument (Internal function)
and in Mozilla:
~ ~ ~ ~ ~ ~
IFRAME id= fr1
IFRAME.hasChildNodes() true
childNodes =[xpconnect wrapped NodeList]
childNodes.length =1
a= [xpconnect wrapped Text]
content:
According to DOM2 specifications,
~ ~ ~ ~ ~ ~
Interface HTMLIFrameElement
Inline subwindows. See the IFRAME element definition in HTML 4.0.
IDL Definition
interface HTMLIFrameElement : HTMLElement {
attribute DOMString align;
attribute DOMString frameBorder;
attribute DOMString height;
attribute DOMString longDesc;
attribute DOMString marginHeight;
attribute DOMString marginWidth;
attribute DOMString name;
attribute DOMString scrolling;
attribute DOMString src;
attribute DOMString width;
// Introduced in DOM Level 2:
readonly attribute Document contentDocument;
};
So contentDocument is a valid DOM2 attribute
(therefor, Konq should return attribute of Document in this testcase)
As soon as you got contentDocument, you can parse it and process some of its
elements in the way you want.
NOTE that this fragment gives appx. the same results both in Mozilla/NS6 and
Konq, so we can't say that "KHTML introduced security hole"
If there is a security hole inside - than it was introduced by W3C/DOM2
group..
I think that easy and reasonable fix for this is to have (optional)
possibility to "Turn Off DOM2::contentDocument exposure" in Web Browsing
settings.
It's ok for Intranet to have it enabled (XML processing, etc.) but for
Internet it should be, probably, disabled.
It would be nice to hear comments both from KMail and KHTML developers.
|
| Although external references are disabled, this "works" in a HTML mail:
|
| <html><head></head><body>
| <iframe width="200" height="300" src="/etc/passwd"></iframe>
| </body></html>
|
| (see the attachment to this mail for an example)
|
| I'm not sure if there are any possible security/privacy problems with
| this, and whether KHTML or KMail is to blame here. Therefore crossposting.
--
Vadim Plessky
http://kde2.newmail.ru (English)
33 Window Decorations and 6 Widget Styles for KDE
http://kde2.newmail.ru/kde_themes.html
KDE mini-Themes
http://kde2.newmail.ru/themes/
_______________________________________________
kmail Developers mailing list
kmail@mail.kde.org
http://mail.kde.org/mailman/listinfo/kmail
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic