3 ms·

We don't let websites access file:// urls, why should they be able to access http://localhost http://localhost urls? Or http://.local http://.local urls?

We don't let websites access file:// urls, why should they be able to access http://localhost http://localhost urls? Or http://*.local http://*.local urls?

baddox 7y ago
To be fair, this is a slightly different issue. External websites can presumably link to file:// or localhost URLs (the one in your comment works fine from the HN website), but they can't transmit any information about the resource back to their servers. That's also true of images (unless the server serving the image allows it via CORS). An evil web page at example.com/evil can certainly contain an img tag for http://localhost/me.jpg http://localhost/me.jpg or http://dropbox.com/private-photo.jpg http://dropbox.com/private-photo.jpg. You will see your private images displayed on their web site, but while that may be disturbing (or even useful for phishing), the evil web page cannot transmit the image data back to itself. For example, it can't use JavaScript to load the image into a canvas, base64 encode the canvas, and POST it back to itself, because the canvas will become "dirty" as soon as the image is loaded into it, and the browser will not allow JavaScript code to dump a dirty canvas to any inspectable format.
- anaphor 7y ago
  They can redirect you as well (or you can put a non-image inside an image tag). Which means you have to make sure it's safe to merely navigate to a page/resource, otherwise you have a "Confused Deputy" vulnerability (i.e. CSRF).
- kzzzznot 7y ago
  Really interested in this, can you provide some more depth/links to articles about how this works?
  - baddox 7y ago
    Here's a straightforward example. https://stackoverflow.com/questions/2390232/why-does-canvas-todataurl-throw-a-security-exception?noredirect=1&lq=1 https://stackoverflow.com/questions/2390232/why-does-canvas-...
  - SCLeo 7y ago
    Not necessarily more depth, but here is one from mozilla. https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabled_image#Security_and_tainted_canvases https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabl...
slang800 7y ago
Why should localhost be different from any other server on the web?

We don't let websites access file:// urls, why should they be able to access http://localhost http://localhost urls? Or http://*.local http://*.local urls?

baddox 7y ago

To be fair, this is a slightly different issue. External websites can presumably link to file:// or localhost URLs (the one in your comment works fine from the HN website), but they can't transmit any information about the resource back to their servers. That's also true of images (unless the server serving the image allows it via CORS). An evil web page at example.com/evil can certainly contain an img tag for http://localhost/me.jpg http://localhost/me.jpg or http://dropbox.com/private-photo.jpg http://dropbox.com/private-photo.jpg. You will see your private images displayed on their web site, but while that may be disturbing (or even useful for phishing), the evil web page cannot transmit the image data back to itself. For example, it can't use JavaScript to load the image into a canvas, base64 encode the canvas, and POST it back to itself, because the canvas will become "dirty" as soon as the image is loaded into it, and the browser will not allow JavaScript code to dump a dirty canvas to any inspectable format.

anaphor 7y ago
They can redirect you as well (or you can put a non-image inside an image tag). Which means you have to make sure it's safe to merely navigate to a page/resource, otherwise you have a "Confused Deputy" vulnerability (i.e. CSRF).
kzzzznot 7y ago
Really interested in this, can you provide some more depth/links to articles about how this works?
- baddox 7y ago
  Here's a straightforward example. https://stackoverflow.com/questions/2390232/why-does-canvas-todataurl-throw-a-security-exception?noredirect=1&lq=1 https://stackoverflow.com/questions/2390232/why-does-canvas-...
- SCLeo 7y ago
  Not necessarily more depth, but here is one from mozilla. https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabled_image#Security_and_tainted_canvases https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabl...

slang800 7y ago

Why should localhost be different from any other server on the web?