Besttoolbars developers network

Back to Besttoolbars main site

FAQ

Memberlist

Usergroups

Profile

security issue in TBS Firefox with config_allowed

BestToolbars.Net Forum Index -> Mozilla/Firefox conversion

Author

Message

taw

Joined: 18 Jun 2007
Posts: 41
Location: Munich, Germany

Posted: Tue Oct 09, 2007 10:47 am Post subject: security issue in TBS Firefox with config_allowed

In tb.xsl we have:

Code:

<xsl:variable name="configallow">
<xsl:for-each select = "child::CONFIGALLOW"><xsl:value-of select="text()"/>;</xsl:for-each>
</xsl:variable>

This results, for example, in a list like "foo.com;bar.com;foobar.com;"

In tb.js, this list is parsed like this:

Code:

if (set_configallow)
{
var ca=set_configallow.getAttribute('value');
if (ca)
{
   var ca_sites=ca.split(';');
   var ci;
   for(ci=0;ci < ca_sites.length;ci++)
   if (href.indexOf(ca_sites[ci]) != -1)
   {
   configallowed=1;
   break;
   }
}
}

Because ";" is always the last character of ca, the last element of ca_sites becomes "". Since string.indexOf("") is always 0, configallowed becomes 1, so every site can configure my toolbar.

Another problem of this usage of indexOf: http://maleware.com/foo.com/badscript.html would be accepted.

taw

Joined: 18 Jun 2007
Posts: 41
Location: Munich, Germany

Posted: Mon Oct 15, 2007 11:23 am Post subject:

I would suggest this diff:

Code:

< if (href.indexOf(ca_sites[ci]) != -1)
---
> if ((href.indexOf(ca_sites[ci]) != -1) && (ca_sites[ci] != "") && (href.indexOf(ca_sites[ci]) < href.indexOf(".")))

Could this be changed in next ToolBarStudio Version?
(There are two positions)

Thank You!

Admin
Site Admin

Joined: 22 Aug 2006
Posts: 1055

Posted: Tue Oct 23, 2007 9:30 am Post subject:

This has been changed in our latest converter from http://www.besttoolbars.net/download.php#mozilla

taw

Joined: 18 Jun 2007
Posts: 41
Location: Munich, Germany

Posted: Tue Oct 30, 2007 8:14 am Post subject:

Sorry!

Code:

< if (href.indexOf(ca_sites[ci]) != -1)
---
> if (((href+"/").indexOf(ca_sites[ci]+"/") != -1) && (ca_sites[ci] != "") && (href.indexOf(ca_sites[ci]) < href.indexOf(".")))

Would be better, so http://goodsite.com.badsite.com/foo.html will not be allowed.

These code can be found two times in tb.js.

Also, I suggest to call ToolBarInit and DocumentComplete only if configallowed==1 ! Wink

Display posts from previous:

	BestToolbars.Net Forum Index -> Mozilla/Firefox conversion	All times are GMT
Page 1 of 1