Subject: Re: [Uri-review] New Version Notification - draft-holsten-about-uri-scheme-05.txt

From: Joseph Anthony Pasquale Holsten <[email-masked]>
Date: Mon, 29 Nov 2010 10:22:04 -0600

On Nov 29, 2010, at 7:15 AM, [email-masked] wrote:

> New version (-05) has been submitted for draft-holsten-about-uri-scheme-05.txt.
> http://www.ietf.org/internet-drafts/draft-holsten-about-uri-scheme-05.txt
> Sub state has been changed to AD Follow up from New Id Needed

Thanks for the new draft!

I noticed this draft removed from section 7, Security Considerations:
	Implementations of the scheme SHOULD NOT modify data when processing"about" resource identifiers.  Applications SHOULD NOT use "about" URIs to access or erase files or other sensitive information.

I do quite like how much clearer the section is, but it now no longer describes a previous security hole in IE where it would display the content of certain about uris. This would allow the page, which usually had a heightened security privilege, to run javascript. The two main vulnerabilities were modifying data and accessing sensitive information to then send it across the wire.

Saying "Implementations SHOULD take care to prevent the construction of "about" URIs that might inadvertently perform damaging local or remote operations" doesn't resolve that. While the implementation constructing the URI may have security considerations, it's vulnerabilities in the consuming implementation that I'm trying to highlight.

Sound reasonable?
--
Joseph Holsten

---

From: Lachlan Hunt <[email-masked]>
Date: Tue, 30 Nov 2010 13:29:02 +0100

On 2010-11-29 17:22, Joseph Anthony Pasquale Holsten wrote:
> I noticed this draft removed from section 7, Security
> Considerations: Implementations of the scheme SHOULD NOT modify data
> when processing"about" resource identifiers.  Applications SHOULD NOT
> use "about" URIs to access or erase files or other sensitive
> information.
>
> I do quite like how much clearer the section is, but it now no longer
> describes a previous security hole in IE where it would display the
> content of certain about uris. This would allow the page, which
> usually had a heightened security privilege, to run javascript.

Could you clarify what you mean or provide a reference that explains 
this issue?

> The two main vulnerabilities were modifying data and accessing sensitive
> information to then send it across the wire.

This is covered by "Applications SHOULD ensure appropriate restrictions 
are in place to protect such information from access or modification by 
untrusted sources."

-- 
Lachlan Hunt - Opera Software
http://lachy.id.au/
http://www.opera.com/