[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #2780 [Torbutton]: Investigate Torbutton translation input validation issue
#2780: Investigate Torbutton translation input validation issue
-----------------------------------------------------------------------------+
Reporter: mikeperry | Owner: mikeperry
Type: defect | Status: new
Priority: blocker | Milestone:
Component: Torbutton | Version:
Keywords: TorbuttonIterationFires20110320 MikePerryIterationFires20110320 | Parent:
Points: 2 | Actualpoints:
-----------------------------------------------------------------------------+
We had a random anonymous person show up on IRC who pointed out that
Transifex was not filtering their input for XSS or other attacks. While
this is bad for our website, it is potentially even worse for Torbutton.
XUL XSS means arbitrary code execution.
I spoke with Dan Veditz and he both half-chastised me for trusting this
input, and also explained the history Mozilla went through before they
managed to make Personas safe to deploy. DTD elements can carry arbitrary
XUL elements. Properties are much less risky unless you use them as
.innerHTML in DOM manipulations.
I also tried to see if I could "break out" of a DTD element used inside an
attribute by closing the quote and injecting a script attribute. I could
not.
I believe this means that only two of our DTD elements should actually be
vulnerable to this.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2780>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs