3 ms·
Exotic protocols being somewhat succeptible to exploits is nothing new (Chrome, Firefox, and Safari have had these in the past as well) and they generally get f
by dvt 10y ago
Exotic protocols being somewhat succeptible to exploits is nothing new (Chrome, Firefox, and Safari have had these in the past as well) and they generally get fixed pretty quickly.
However, the fact that the "read:" protocol is a thing -- and the fact that it works the way it works -- is absolutely insane. Who in their right mind would think that's a good idea? Forget sandboxing, who's bright idea was it to let a web browser access local files willy-nilly? Mind-boggling.
The first thing I'd say if someone came to me with that idea is (a) no way and (b) if you really want to do it, you need a security mechanism like 300x stronger than CORS and probably a popup that lets the user know what's going on.
- Klathmon 10y agoEven (b) is pushing IMO. There's a reason the standards have evolved to be this restrictive. If you want to allow a way to get around those restrictions (with "you" being a browser vendor), then you should go through the standardization process. 9/10 these "good intentioned" additions to browsers end up being used in exploits, and even if they aren't just being in one browser is rarely useful.
- dvt 10y agoYep, totally agree. The exploiting potential far outweighs the usefulness.
- crazy2be 10y agoI don't know, I can't see any way that the read: protocol is any more vulnerable than the file: protocol (standard on all browsers), other than the fact that the code is probably less battle-tested.
- userbinator 10y agoThe part of the string before the comma may do something interesting; further reverse-engineering may reveal its purpose, but what I'd like to know more is what application(s) actually use read: and for what.
- kalleboo 10y agoFrom the function names in the stack trace, I assume it's the internal protocol used for "Reading View" https://support.microsoft.com/en-us/help/17204/windows-10-take-your-reading-with-you https://support.microsoft.com/en-us/help/17204/windows-10-ta...
- userbinator 10y agoThat somewhat makes sense, but then one wonders why it wasn't restricted in the same way as file:// or the usual http(s):// protocols. Of course "Reading View" could've been implemented in a simpler way that people were accomplishing the same thing before (either saving the pages or their URLs to a centralised place), but leave it to MS to reinvent it in the form of an overly complex and insecure solution...