4 ms·
Can't agree more that URL syntax is overcomplicated. Even existing URL parsing libraries behave inconsistently and lead to security vulnerabilities [0]. [0] ht
by lsc36 9y ago
Can't agree more that URL syntax is overcomplicated. Even existing URL parsing libraries behave inconsistently and lead to security vulnerabilities [0].
[0] https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-Ne...
- jklinger410 9y agoWithout commentary these slides are entirely unhelpful. Someone would have to agree with you already and have a head start on the purpose this presentation in order to understand what is going on here. Care to elaborate?
- arkadiyt 9y agoBlackhat/Defcon videos aren't up yet but Orange Tsai gave the same talk at HITBGSEC and that video is up: https://www.youtube.com/watch?v=D1S-G8rJrEk https://www.youtube.com/watch?v=D1S-G8rJrEk He also has a blog post about it: http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilitie... The premise is that URL parsing is complex and libraries get it wrong. This problem is pervasive and leads to server side request forgery vulnerabilities, which Orange was able to escalate to remote code execution on Github.