Re: XSS on Yahoo Mail

From: Jim Ley (jim_at_jibbering.com)
Date: 11/24/05

  • Next message: Personal Account: "Re: XSS on Yahoo Mail"
    To: bugtraq@securityfocus.com
    Date:  Thu, 24 Nov 2005 19:28:45 -0000
    
    

    "Will Wesley" <willwesleyccna@yahoo.de> wrote in message
    news:20051124025004.32883.qmail@web26902.mail.ukl.yahoo.com...

    >This is not exactly a problem with Yahoo!, but rather
    >a problem with the way browsers tend to render HTML
    >when forced to deal with broken tags.

    So it's a problem with Yahoo, as they allow the email, to write to places on
    the screen that is not part of the email. I agree this is certainly down to
    the liberalness of the browsers parser, but that doesn't mean yahoo can
    ignore it, it's just a demonstration of how difficult a job it is for people
    who want to accept arbitrary HTML to be secure for their user

    Of course there is a pretty simple solution, which is to just use an IFRAME,
    then there's no way the email to escape into the surrounding chrome.

    Jim.


  • Next message: Personal Account: "Re: XSS on Yahoo Mail"