4 ms·
It seems like this is allowed by design, so am I missing something? Why hasn't such a "feature" been turned off by all the newest browsers and rendering engines
by mikemoka 13y ago
It seems like this is allowed by design, so am I missing something? Why hasn't such a "feature" been turned off by all the newest browsers and rendering engines?
I know this method could have been made available for canvas image editing purposes but is there any legitimate reason for allowing javascript to be executed as well and not to strip it out automatically?
- aaronem 13y agoWhat's happening isn't that the canvas is being told "load this image, find some Javascript in it, and execute that", which would make your comment make sense. Instead, it's just being used as a means of getting the PNG bytes and turning them into a string of characters, which gets passed to a callback that's passed into the loadPNGData function. As far as I can tell, it's more than anything a means of smuggling exploit code past antivirus &c., and into the browser -- presumably nothing is looking for Javascript source hidden in a PNG file, and there's nothing to say it couldn't be obfuscated further. On the other hand, being able to strip the code out of the image and execute it requires being able to execute Javascript code on the target browser already, so I'm really not sure what benefit the technique has for the attacker; if you can get your target to run your script loader, you can probably just get your target to run your script.
- sesqu 13y agoI believe the point of the technique is that it may avoid some heuristics that malware scanners use to identify loaders.