Bugtraq mailing list archives
Re: XSS on Yahoo Mail
From: Will Wesley <willwesleyccna () yahoo de>
Date: Sat, 26 Nov 2005 01:00:30 +0100 (CET)
--- Steven Champeon <schampeo () hesketh com> schrieb:
I think you missed the point. He's actually just inserting ill-formed markup into the document flow and the browsers do react in the ways he described to such markup. As such, the problem exists. Calling out moron Web designers doesn't help much here. In HTML 3.2 and 4.0, for example, an open TD tag is required, so when non-markup text follows a start TR tag, the browser doesn't know how to deal with that text and places it out of the table's document flow, which has the result of throwing it further up the page, outside /and preceding/ the table in which it was found. This is a well-known problem to Web designers (who used to use it to troubleshoot complex table-based page layouts), but it doesn't mitigate its importance to those concerned with preventing XSS. Steve
I didn't miss the point. He's actually just inserting malformed data that the browser doesn't know what to do with. Isn't that what I said? I only intended to point out what the problem really was. It's not injecting scripts to run under Yahoo's priveledges, no information is passed to a third party, and either some very simple social engineering or a real XSS vuln would need to be employed to pass any information. Calling out moron web devers is useless, I agree. But it's just as pointless as pointing out that incorrectly using tags is a way of troubleshooting. I had a point with the original statement, but it escapes me. Anyway, a solution is really quite simple. Allow users to disable HTML in their email, or why not by default? - Will Wesley, BSCS http://wieso.blogdrive.com ___________________________________________________________ Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier anmelden: http://mail.yahoo.de
Current thread:
- XSS on Yahoo Mail Richard Fuchshuber (Nov 23)
- RE: XSS on Yahoo Mail Will Wesley (Nov 24)
- Re: XSS on Yahoo Mail Steven Champeon (Nov 26)
- Re: XSS on Yahoo Mail Will Wesley (Nov 26)
- Re: XSS on Yahoo Mail Jim Ley (Nov 26)
- RE: XSS on Yahoo Mail Richard Fuchshuber (Nov 26)
- Re: XSS on Yahoo Mail Steven Champeon (Nov 26)
- Re: XSS on Yahoo Mail Personal Account (Nov 26)
- <Possible follow-ups>
- Re: XSS on Yahoo Mail little . hacker (Nov 26)
- Re: XSS on Yahoo Mail Matan Peled (Nov 26)
- Re: XSS on Yahoo Mail alireza hassani (Nov 26)
- Re: XSS on Yahoo Mail Lance James (Nov 28)
- RE: XSS on Yahoo Mail Will Wesley (Nov 24)