5 ms·
Congratulations, the user is on your website, running your malicious javascript. Which is going to do what, exactly? It doesn't have access to any other site's
by AndyKelley 14y ago
Congratulations, the user is on your website, running your malicious javascript. Which is going to do what, exactly? It doesn't have access to any other site's cookies or information.
- jack-r-abbit 14y agoI think (s?)he meant upload the image to someone else's site. The malicious code be running on that site... not your own. So then it does have access to that site's cookies.
- AndyKelley 14y agonope, in this case the image will be interpreted as an image, not a script.
- jack-r-abbit 14y agoRight. I just took the example squirrel page, saved it, altered the comment section of the image to insert some javascript code alert('Hello') and opened it in my browser. It works but only if it is interpreted as html. So you'd need to be able to control it more.
- __alexs 14y agoBe incredibly annoying and make you look like an idiot? e.g. the MySpace worm http://namb.la/popular/tech.html http://namb.la/popular/tech.html
- zethraeus 14y agowell, after all samy is my hero.
- eric_arrr 14y agoYeah, what jack-r-abbit said: the point is you've got malicious script embedded in a page from somebody else's web site, so you have access to cookies and can inspect and/or manipulate the user's session arbitrarily.
- AndyKelley 14y agoNope, you have an image embedded in somebody else's web site, the script never runs. Also that's completely different than what you originally said.
- eric_arrr 14y agoAndy, you're very confused.
- AndyKelley 14y agoLook. You are the one making the claim that you can exploit this. I call bullshit. So either prove it, or drop it. Accusing me of being "confused" does not provide evidence for your claim.
- eric_arrr 14y agoI'm not sure where I appeared to contradict myself in my earlier posts, so I'm unsure how to clarify this for you. Best I can do is this: Here is a link to a variation of the "image" file which is the subject of this post: https://dl.dropbox.com/u/131649/squirrel.html https://dl.dropbox.com/u/131649/squirrel.html I have embedded harmless (-- honest! --) script in the file to demonstrate that your browser will execute the script in the context of the site where the file is hosted. So, click the link. (Again I promise that no harm will come to your computer.) Now imagine that dl.dropbox.com is, instead, some hypothetical site where users are expected to upload images, but not HTML documents containing arbitrary script, and the security implications should be fairly obvious.