4 ms·
> Don't all protocol handlers invoke some execution? Sure, but you don't expect arbitrary code execution. The important distinction is whether the attacker can
by TonyTrapp 5y ago
> Don't all protocol handlers invoke some execution?
Sure, but you don't expect arbitrary code execution. The important distinction is whether the attacker can control what is executed. So if you click on a HTTPS link, you should be safe to assume that it opens a new browser tab, and not open a command prompt like in that example.
- londons_explore 5y agocmd://calc.exe Nobody said URL handlers should offer any security guarantees. There is no clear amount of things that a clicked URL should be able to do. In some circumstances, the full permissions of the logged in user would be appropriate. The security onus really ought to be on the application which sourced the URL - it knows where it came from.
- TonyTrapp 5y agoThe problem is twofold - the sourcing application should tell you which protocol handler is being invoked (this is where IE/Edge fails) - but the protocol handler itself should also not do anything unexpected. When you open a https:// https://.... link, you know it's not going to run a local application. Similarly, ms-officecmd:... should open some sort of Office application, and nothing else. I think that's the minimum of a security guarantee you can expect from any program.