10 ms·
Great catch and everyone should know there is an easy way to parse URLs in JS. Just create an anchor element and let the browser parse it for you. Like so: var
by cyberpanther 10y ago
Great catch and everyone should know there is an easy way to parse URLs in JS. Just create an anchor element and let the browser parse it for you. Like so:
var parser = document.createElement('a');
parser.href = "http://example.com:3000/pathname/?search=test#hash"; http://example.com:3000/pathname/?search=test#hash";
parser.protocol; // => "http:"
parser.hostname; // => "example.com"
parser.port; // => "3000"
parser.pathname; // => "/pathname/"
parser.search; // => "?search=test"
parser.hash; // => "#hash"
parser.host; // => "example.com:3000"
- jxpx777 10y agoDisclosure: I work for AgileBits, makers of 1Password. For browser extensions, the URL constructor would be even easier: https://developer.mozilla.org/en-US/docs/Web/API/URL/URL https://developer.mozilla.org/en-US/docs/Web/API/URL/URL (Yes, I know it says that IE doesn't support it, but IE doesn't have a proper extensions framework, so it's irrelevant to this topic.)
- tedmiston 10y agoWhile you are here, can you confirm whether a similar regex vulnerability does not affect 1Password?
- kordless 10y agoWhat you are really "asking" is logically equivalent to this blaming statement: "I see you are posting about LastPass' vulnerability, but you work for 1Password. Please confirm there exists a regex vulnerability in 1Password which is similar in nature to the one that occurred with LastPass." Put this way, the insanity of the statement is obvious. In questions, it becomes less obvious to the majority of the population, which only serves to spread the insanity to others. Don't feed the fear with dissonance. Edit: It is NOT "reasonable" to ask questions with negation in them which assume blame in a piece of software which is, by a rather large assumption, a completely different code base. Reason is based on logic. This question was based on fear and uncertainty, and only serves to spread it further. You downvoters can go fuck yourselves.
- XMPPwocky 10y agoI see no need to read that into it. It's a reasonable question. Sounds like they just want to know if they, as a 1Password customer, could be affected. A little misguided, but a reasonable question.
- matt_wulfeck 10y agoOr maybe he's just curious if this type of url regex fail is more widespread among similar software.
- kordless 10y agoThen say that as a hypothesis and stop asking leading questions (which are blaming in nature) from people who make it their business.
- tedmiston 10y agoWhile this is something I'm generally curious of, especially with regex vulnerabilities being such a hot topic in software right now. See, for example, the regex issue last week that caused Stack Overflow to go down [0]. That aside, my concern stems solely from being a 1Password customer. [0]: Stack Overflow Outage Postmortem https://news.ycombinator.com/item?id=12131909 https://news.ycombinator.com/item?id=12131909
- tedmiston 10y agoHere's some context: I am a former LastPass user for many years and current (concerned) 1Password user wondering if I should be changing all of my passwords again. My goal was to settle concern for myself and other 1Password users. That's why I wrote whether a similar vulnerability "does not affect 1Password" instead of "does". My apologies if this was unclear.
- balls187 10y agoWhy did you switch from LastPass to 1Password? I recently started using LastPass after years of reusing the same uncrackable password: !p@ssword123
- throwanem 10y agoWhy not take a look at the code injected by 1Password's browser extension and find out for yourself whether it handles URLs safely? That shouldn't be hard to do, and it's a lot healthier for the community than discouraging devs to participate by taking their presence as an opportunity for drive-by pot shots.
- tedmiston 10y agoI'm sorry, but I don't see how asking an employee of the company that makes the product that I use every day is "discouraging devs to participate by taking their presence as an opportunity for drive-by pot shots". I think an official word holds more clout and is more valuable than any one person confirming for themselves in one version of one browser on one version of one OS.
- throwanem 10y agoI did speak rather harshly in my prior comment, and for that I apologize. Worse, I did a very poor job of expressing the concern that motivated me to respond. But I think it's still fair to ask whether your initial comment has value. I understand that, as a user of 1Password's browser extension(s), you may well feel some concern that a similar vulnerability exists, and I don't think it's unreasonable to want reassurance on that score. But I think your phrasing and framing of the question feels a lot more like a "gotcha" than anything else, and it's that feeling which motivated my prior comment - I'm not an AgileBits dev myself, but if I were, I'd feel strongly inclined to shy away from that question rather than trying to frame an answer that doesn't leave me open to a potentially hostile followup.
- jamie_ca 10y agoNot a dev on either product, but I use 1Password for my personal accounts, and a corporate LastPass for my work accounts. I do not believe that 1Password is as immediately vulnerable as LastPass. LastPass (on Chrome) will auto-fill information on a detected site, which a malicious site can read immediately. 1Password (on Chromium nightly) requires me to hit the 1Password Mini button and select a site/account to log in with. If 1Password had a similar vulnerability, a malicious site as described would merely wind up showing me accounts for the wrong site in the dropdown. Clicking one could wind up submitting/leaking my credentials to the attacker, though.
- notJim 10y ago1Password doesn't auto-fill, but you can press [Ctrl|CMD] + \ to fill in the password automatically based on the detected domain.
- unfletch 10y agoIt does have an "open and fill" feature which autofills, but only immediately after opening the site by URL first. (So the attacker's URL would have to be saved in 1Password along side your credentials.) This is actually how I use 1Password most often. Global hotkey of cmd+opt+\, type a site name, hit enter: 1Password opens the site and logs in.
- ruipgil 10y agoIf they're not using regex, they can't be affected by it anyways
- K0nserv 10y agoI had a quick look at the 1Password chrome extension source and it seems to me like they are using window.URL[0]. See this pastebin[1] for the function I believe is determining the url of the active tab and if it has a valid hostname. There's also this one[2] that seems to be extracting the hostname of a given url also using the URL API. Both these pastebins contain minimized code that I've cleaned up. 0: https://developer.mozilla.org/en-US/docs/Web/API/URL https://developer.mozilla.org/en-US/docs/Web/API/URL 1: http://pastebin.com/tWns7XmG http://pastebin.com/tWns7XmG 2: http://pastebin.com/PXS1iqsq http://pastebin.com/PXS1iqsq
- cyberpanther 10y agoURL constructor looks great! Just wish it was stable. I normally don't have to worry about IE very much anymore anyways.
- deleted 10y ago[deleted]
- dkopi 10y agoWhile that might be an "easy way" - it isn't a secure way in this case. Since malicious attackers have complete control over the page you're seeing - they can simply replace document.createElement with their own function. And instead of returning a DOM object, they can return an object that returns whatever they want in .hostname
- Navarr 10y agoAt least in Chrome, I'm imagining the raw url would be sent to a background process that is sandboxed from the webpage and would then do the createElement stuff.
- JackC 10y agoI think the point is that this would run in a document belonging to the LastPass extension -- not that it would run in javascript injected into the target site. The same attack you describe could be applied to basically any javascript you cared to write (say, String.prototype.length). The safest approach is to treat the output of injected javascript as untrusted third-party input to your extension code and work from there.
- jxpx777 10y agoDisclosure: I work for AgileBits, makers of 1Password. For desktop browser extensions that are properly using the frameworks, the extension's Javascript runs in its own execution context so the page cannot redefine variables. This protected 1Password when we discovered that a certain page had redefined the global JSON object, which provides parse and stringify functions among other things, to be the number 3, i.e. a numeric constant called JSON. :'D
- favadi 10y agoWhen you are here, is 1password for team is the future and the classic 1password will become obsolete soon?
- AGKyle 10y agoDisclaimer: I also work for AgileBits We really try not to call it "Classic" or anything like that. It's standalone, you're in charge of upgrades, syncing and backups and stuff like that. It's also not designed for sharing (at least to the degree of the Family and Team solutions). That said, we don't have any immediate plans to remove the standalone products. However, if a vast majority of our users switch to 1Password Family or 1Password Teams (and as of today, an Individual plan!) then it doesn't make a ton of sense to keep the standalone product around. So, it's probably one of those speak with your wallet kind of scenarios. I'll certainly pass your feedback along, it sounds like you'd like to keep it around. I hope that helps answer your question :) Kyle AgileBits
- draw_down 10y agoBut that shouldn't be necessary here, if I understand the problem correctly. The code Lastpass was looking for was simply `document.location.hostname`.