8 ms·
Well, this is cool, but Safari allows for loading basically any file located on the filesystem. For instance, trying file:///etc/passwd results in file found bu
by kaivi 12y ago
Well, this is cool, but Safari allows for loading basically any file located on the filesystem. For instance, trying file:///etc/passwd results in file found but can not be opened by Safari.
That could be an attack vector.
- shortstuffsushi 12y agoCould you explain where you think the issue here is? Are you saying, as a user trying to upload, you could possibly (presumably accidentally) upload your passwd, or as a user of their site, you could somehow see their passwd file? If it's the former, I think that's a 'vulnerability' with any site that has a file chooser. If it's the latter, could you elaborate where and how you would do so? Perhaps you're saying you could load it through the simulator that's running on the actual computer/vm somewhere, but those simulator environment are sandboxes (afaik) so that you could only access files on within the simulator's context.
- chrisnolet 12y agoSimulator instances aren't sandboxed, so you can transverse the master system's file system with a malicious iOS app. This is indeed an attack vector.
- shortstuffsushi 12y agoHuh, indeed they are not. Was able to pull a file off my desktop through Safari. Was not aware of that.
- weiyin 12y agoAgreed. This is an issue not just for Safari, but someone can upload a specially crafted app that browses the file system. In this iteration we are using the OS permission system to isolate users. We are looking into more effective sandbox methods. Security is an ongoing process, and we always take an adversarial point of view when evaluating our system.