[avtokyo2015] threat of data url scheme they are still here
Post on 15-Apr-2017
1.238 Views
Preview:
TRANSCRIPT
data:image/png;base64,
iVBORw0KGgoAAAANS
UhEUgAAAZAAAAGQCA
YAAACAvzbMAAAgAElE
QVR4nOydZ3wUVRfGJ8
mm103vvZfNplEURF5E
UFHpSBNpihRRikpTQAT
pSE3oIEVUREEBaSpFR…
google.com Generate
Generate evil.tld
data:
data:
RFC doesn't mention how a browser
should set the origin of data:
AVTOKYO2015 Nov 14, 2015 1
The differences in
behavior of data: URL
among web browsers
The differences in
behavior of data: URL
among web browsers
The data: URLs can be used only for following
elements and attributes
object
img
input type=image
link
CSS properties that accept URL as a value
(e.g., background, background-image and etc.)
AVTOKYO2015 Nov 14, 2015 5
IE cannot open data:text/html
↑ Firefox ↑ Chrome
<iframe src=”data:text/html,test”></iframe>
AVTOKYO2015 Nov 14, 2015 6
Other web browsers
In Firefox, content from data: URLs inherits the
origin from the document that loaded the URL in
an iframe and etc.
AVTOKYO2015 Nov 14, 2015 8
Inherits the origin from the opener
Its behavior is sometimes completely different
among browsers
Potential vulnerabilities introduced by such
'self-indulgent' implementations
Corresponding spec is often not disclosed
AVTOKYO2015 Nov 14, 2015 12
data: URL is messy
Browser: Firefox
AVTOKYO2015 Nov 14, 2015 14
data: URL can be used as
a bookmarklet
data: URL can be used as
a bookmarklet
Browser: Chrome, Safari (iOS)
AVTOKYO2015 Nov 14, 2015 16
The differences in MIME type
of data: URL
The differences in MIME type
of data: URL
The differences in MIME type of
data: URL
data:application/octet-stream,test
AVTOKYO2015 Nov 14, 2015 17
The differences in MIME type of
data: URL
data:application/octet-stream,test
AVTOKYO2015 Nov 14, 2015 18
data:application/octet-strea,test
blob: URL
var text = "<h1>Hello</h1>"
var blob = new Blob([text], {type : 'text/html'});
var url = URL.createObjectURL(blob);
blob: pages made by data:
could steal localStorage of file:
http: Generate
data: blob: Generate
file:
localStorage Steal from the internet
top related