11 ms·

I can't replicate this with current Thunderbird 68.11.0 on Debian. It honors parameters such as subject= and body=, but attach= seems to be ignored. After a qu

by avian 6y ago

I can't replicate this with current Thunderbird 68.11.0 on Debian. It honors parameters such as subject= and body=, but attach= seems to be ignored. After a quick search through the paper [1] it seems that authors forgot to mention the software versions they were using in their research. [1] https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2020/08/15/mailto-paper.pdf https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichu...

miken123 6y ago
It should be patched since Dec 2019: https://twitter.com/jensvoid/status/1295633279727673344 https://twitter.com/jensvoid/status/1295633279727673344
- avian 6y ago
  I found a discussion from March 2009 which suggests this issue was known back then [1]. Maybe the same feature was re-introduced later in some other part of the code? The link to source repo in the post is dead, but the file it references (nsSmtpUrl.cpp) still contains this comment on line 88 in current version: /* DO NOT support attachment= in mailto urls. This poses a security fire hole!!! [1] http://forums.mozillazine.org/viewtopic.php?f=30&t=1172555 http://forums.mozillazine.org/viewtopic.php?f=30&t=1172555
  - m4tthumphrey 6y ago
    That interesting as the OP is using `attachment` as the param when it is/was actually `attach`.
  - TheSoftwareGuy 6y ago
    Looking at the linked src code, there’s lots of mixed tabs/spaces for indent. shudders
  - sukilot 6y ago
    A comment in source code. Not the discerning professional's preferred tool for guaranteeing security-critical behaviors to prevent "fire holes".
    - setzer22 6y ago
      What should they do? Static analysis would be nice, but it's probably too complex to adopt in that kind of codebase. In the end, the only viable option is to forbid this behaviour, and document a rationale so nobody will enable it back again. Perhaps they could make this warning bigger, but other than that...
      - jefftk 6y ago
        They could have added a regression test, no? Give it an example with ?attach= and verify that no attachment is added.
hannob 6y ago
It seems the thunderbird issue is actually an issue in xdg-open, see: https://bugzilla.mozilla.org/show_bug.cgi?id=1613425 https://bugzilla.mozilla.org/show_bug.cgi?id=1613425 https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177 https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177 So you are only affected if your system uses xdg-open to parse mailto links.

by avian 6y ago

miken123 6y ago

It should be patched since Dec 2019: https://twitter.com/jensvoid/status/1295633279727673344 https://twitter.com/jensvoid/status/1295633279727673344

avian 6y ago
I found a discussion from March 2009 which suggests this issue was known back then [1]. Maybe the same feature was re-introduced later in some other part of the code? The link to source repo in the post is dead, but the file it references (nsSmtpUrl.cpp) still contains this comment on line 88 in current version: /* DO NOT support attachment= in mailto urls. This poses a security fire hole!!! [1] http://forums.mozillazine.org/viewtopic.php?f=30&t=1172555 http://forums.mozillazine.org/viewtopic.php?f=30&t=1172555
- m4tthumphrey 6y ago
  That interesting as the OP is using `attachment` as the param when it is/was actually `attach`.
- TheSoftwareGuy 6y ago
  Looking at the linked src code, there’s lots of mixed tabs/spaces for indent. shudders
- sukilot 6y ago
  A comment in source code. Not the discerning professional's preferred tool for guaranteeing security-critical behaviors to prevent "fire holes".
  - setzer22 6y ago
    What should they do? Static analysis would be nice, but it's probably too complex to adopt in that kind of codebase. In the end, the only viable option is to forbid this behaviour, and document a rationale so nobody will enable it back again. Perhaps they could make this warning bigger, but other than that...
    - jefftk 6y ago
      They could have added a regression test, no? Give it an example with ?attach= and verify that no attachment is added.

hannob 6y ago

It seems the thunderbird issue is actually an issue in xdg-open, see: https://bugzilla.mozilla.org/show_bug.cgi?id=1613425 https://bugzilla.mozilla.org/show_bug.cgi?id=1613425 https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177 https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177 So you are only affected if your system uses xdg-open to parse mailto links.