[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #1816 [Torbutton]: Create a prototype Content Script for Google Chrome

#1816: Create a prototype Content Script for Google Chrome
------------------------+---------------------------------------------------
  Reporter:  mikeperry  |       Owner:  mikeperry
      Type:  task       |      Status:  closed   
  Priority:  normal     |   Milestone:           
 Component:  Torbutton  |     Version:           
Resolution:  fixed      |    Keywords:           
    Parent:  #1770      |  
------------------------+---------------------------------------------------

Comment(by mikeperry):

 Ok, I just got back from my meeting with Adam Barth and Pam Greene at
 Google. Adam is familiar with Firefox js rootkit/closure busting
 techniques, and he tried out a few common ones but couldn't directly undo
 our hooks.

 However, he was able to bypass them by doing anything that induced chrome
 to load an about:blank window, because the content scripts do not get
 applied. This includes:

 <iframe src="about:blank" id="myframe"></iframe>
 <script>
 var frame = document.getElementById("myframe");
 window.alert(frame.contentWindow.screen.availHeight);
 </script>

 But also, more subtly:
 <script>
 function haxor() {
     var win =3D window.open('/');
     alert(win.screen.availHeight);
 }
 </script>
 <button onclick=3D"haxor()">Try to haxor</button>

 More directly, encoding anything into a data url and throwing it in the
 url bar or elsewhere is also not covered by their content script
 injection:

 <html><script>alert(window.Date());</script></html>

 So we've got to convince chrome to allow us to inject content scripts into
 about:blank windows and data urls.

 The good news is that race conditions do not seem possible with our
 approach. I put a pretty fat delay loop into the content script before
 doing the injection, and page script did not load first.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/1816#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs