Full Disclosure mailing list archives
Re: shell:windows command question
From: Barry Fitzgerald <bkfsec () sdf lonestar org>
Date: Thu, 08 Jul 2004 09:29:31 -0400
Andreas Sandblad wrote:
Did some quick search on Bugzilla and came up with the following: Mozilla allows external protocols as discussed in: http://bugzilla.mozilla.org/show_bug.cgi?id=167475 They seem to blacklist the following external protocol handlers: (patch http://bugzilla.mozilla.org/attachment.cgi?id=102263&action=view) hcp, vbscript, javascript, ms-help, vnd.ms.radio A simple solution would be to add the shell protocol to this list. Personally I think a secure blacklist is hard to maintain as new dangerous external protocols could be invented by third-parties leaving Mozilla vulnerable again.
Completely agreed. There should be a whitelist, not a blacklist... a safe protocols list. -Barry _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- shell:windows command question Perrymon, Josh L. (Jul 07)
- Re: shell:windows command question Andreas Sandblad (Jul 07)
- Re: shell:windows command question Barry Fitzgerald (Jul 07)
- Re: shell:windows command question Komrade (Jul 07)
- Re: shell:windows command question Eric Paynter (Jul 07)
- Re: shell:windows command question Xavier Beaudouin (Jul 08)
- Re: shell:windows command question Barry Fitzgerald (Jul 07)
- Re: shell:windows command question Andreas Sandblad (Jul 08)
- Re: shell:windows command question Andreas Sandblad (Jul 08)
- Re: shell:windows command question Barry Fitzgerald (Jul 08)
- Re: shell:windows command question Darren Reed (Jul 08)
- Re: shell:windows command question Barry Fitzgerald (Jul 08)
- Re: shell:windows command question Darren Reed (Jul 08)
- Re: shell:windows command question Andreas Sandblad (Jul 07)
- <Possible follow-ups>
- RE: shell:windows command question Perrymon, Josh L. (Jul 08)
- Re: shell:windows command question Andrew Poodle (Jul 08)
- RE: shell:windows command question Clairmont, Jan M (Jul 08)
- RE: shell:windows command question Perrymon, Josh L. (Jul 08)
- Re: shell:windows command question Keith and Kelley (Jul 08)
- Re: shell:windows command question Keith (Jul 08)