Saturday, October 15, 2011

Local URIs are more equal than others (Part 1)

On Wednesday, Cedric Sodhi asked the WebKit development mailing list why WebKit restricts access to local URIs.  This post describes one of the reasons why local URIs are more equal than other URIs.  In a future post, we'll revisit this issue when we discuss how local URIs (e.g., file:///Users/abarth/tax2010.pdf) don't really fit cleanly into the web security model.

Although the web platform largely isolates different origins from each other, there are a number of "leaks" whereby one origin can extract information from another origin.  For example, browsers let one origin embed images from another origin, leaking information such as the height and width of the images across origins.  These leaks are often at the core of security vulnerabilities in the platform.

These same leak exists, of course, between local origins (e.g., those with file URIs) and non-local origins (e.g., those with http or https URIs).  What kind of information could a web site extract from your local system using this leak?

On my laptop, I have Skype installed, which means that, on my laptop, the URI below resolves to a PNG image with a particular height and width:
file:///Applications/Skype.app/Contents/Resources/SmallBlackDot.png
If I visit a web site, if the browser doesn't address this leak, the web site could determine whether I have Skype installed by attempting to load that URI as an image.  On my laptop, the image element would have a certain well-known height and width, but on a laptop without Skype installed, the browser would fire the error event.

Returning to Cedric's question, why do browser vendors restrict access to local URIs but not to non-local URIs if both have the same information leak?  I would prefer to close this leak in both cases, but many web sites embed cross-origin images, e.g. from content delivery networks.  If we were adding the <img> tag today, we would probably require servers opt in to cross-origin embedding using the Cross-Origin Resource Sharing protocol.

Fortunately, very few web sites include images (or other resources) from local URIs (especially after we removed the full path from <input type="file">, but that's a story for another time).  That means browsers can block all loads of local resources by non-local origins without making users sad, preventing web sites from snooping on your local file system.

81 comments:

  1. " If we were adding the 'img' tag today, we would probably require servers opt in to cross-origin embedding using [the CORS protocol]." Is there an easy way to use CORS for such tasks without inventing a JS DSL? Such a perspective suggests CORS isn't integrated into basic APIs, making productive programming unsecure-by-default even with the fix. I hadn't followed the API support for CORS, so I'm surprised!

    ReplyDelete
  2. Leo, I'm not sure I understand your question. The browser needs to help the web site make a CORS request when loading images. For example, there's no way for a web site to attach the Origin header to a request without help from the browser because we want the Origin header to accurately reflect the origin of the requester.

    As to the broader thrust of your question, the default behavior for loading images very likely to remain unchanged (i.e., insecure) because changing the default would likely break every web site.

    ReplyDelete
  3. This comment has been removed by the author.

    ReplyDelete
  4. Hi,
    I read your Great Article. There have great news for every visitor. I like your blog and analysis about it. Thanks for your Posting.
    Enjoy Entertainer Please see the link- radio streaming hosting.

    ReplyDelete
  5. Hello,I am very impress after read your great article.
    greengeeks Coupons

    ReplyDelete
  6. This is a great post ! it was very informative. I look forward in reading more of your work. Also, I made sure to bookmark your website so I can come back later. I enjoyed every moment of reading it.
    baju batik modern baju batik baju batik wanita batik pekalongan batik couple batik online batik modern gamis batik

    ReplyDelete
  7. This is a great post ! it was very informative. I look forward in reading more of your work. Also, I made sure to bookmark your website so I can come back later. I enjoyed every moment of reading it.
    baju batik modern baju batik baju batik wanita batik pekalongan batik couple batik online batik modern gamis batik

    ReplyDelete
  8. Pune Escort service - If you are searching for a friendly and beautiful girl to spend some time with do not look farther.
    Kolkata Escorts - is committed to providing excellent service oriented towards customer satisfaction.
    Pune Escorts Agency - Our popularity is a product of our honesty, every picture on this website is genuine so we can guarantee
    Pune EscortsThose kind of girls are basically known as high profile escorts in Pune and they would be very much happy from their profession because they would love to change their life with all that glitter and love.
    Chennai Escorts Agency - We are among the best chennai escorts serving my elite clientele in and around the city of chennai. The city of Pune is a vast industrial hub and is visited by a large number of people with various purposes in hand,
    Kolkata Escorts Agency - you will going to find out many girls who became a Escorts in kolkata just for the sake of money.
    Chennai Escorts - Independent Chennai escorts are known for their credibility and reliability.

    ReplyDelete
  9. You have done a great job. I will definitely dig it and personally recommend to my friends. I am confident they will be benefited from this site.
    vashikaran mantra in Hindi

    ReplyDelete
  10. I really appreciate the kind of topics you post here. Thanks for sharing us a great information that is actually helpful.
    Black Magic Specialist in Noida

    ReplyDelete
  11. Jaipur Escorts | Udaipur Escorts | Jodhpure Escorts | Jaipur Escorts |

    http://top10jaipurmodels.in | http://udaipurescorts.org.in |

    http://jodhpurescortservice.in | http://bestjaipurescorts.in

    ReplyDelete
  12. This is great do you have a catologue if so I would love one to share with friends and family.
    Vivo IPL 2016 Auction
    IPL 2016 Teams Auction
    IPL 9 Auction

    ReplyDelete

  13. Very classy Mumbai independent escort girl name is Dipika kaur. She is very elegant and bold but wants to tell you something important about her she is not a professional escort girl you can get her if you have good luck with you. She is a top class model girl with popular brands.Mumbai Escorts

    ReplyDelete
  14. This is very nice blog and informative. I have searched many sites but was not able to get information same as your site. I really like the ideas and very intersting to read so much and Please Update and i would love to read more from your site
    Thanks

    lic online payment registration
    lic history

    ReplyDelete
  15. I be informed highly on heart-breaking it and lady-love erudition way more on this

    topic.Find great deals on Latexcorsets.com for Plus Size Corsets in Women's Corsets and

    Bustiers. Wholesale with confidence.Full selection of plus size corsets:S, M, L, XL,

    2XL, 3XL, 4XL, 5XL, 6XL.http://www.latexcorsets.com/plus-size-corsets-c-201.html

    ReplyDelete
  16. Enjoy!!! the all latest updates of Vivo IPL 9 t20 live streaming-

    IPL t20 live online stream

    ReplyDelete
  17. This is a great web site. Good sparkling user interface and very informative blogs. I will be coming back in a bit, thanks for the great article. I have found it enormously useful.
    4th and goal
    apple shooter
    age of war
    age of war 2
    big head football
    bloons tower defense 5
    bomberman

    ReplyDelete
  18. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    earn to die

    tank trouble
    Hi! I’ve been reading your blog for a while
    now and finally got the courage to go ahead and give youu a shout out from Austin Texas! Just wanted to tell you keep up the fantastic work!my weblog:
    happy wheels
    earn to die game
    tank trouble game
    earn to die hot

    ReplyDelete
  19. My name is Preeti Patel, twenty four years and that i may be the perfect call on the off probability that you simply love Ahmedabad escorts young women.
    Ahmedabad Escorts Call Girls
    Ahmedabad Female Escorts Call Girls

    I will provide you with a selective sensual escort involvement in an exceedingly tight and tolerable means. i’m the right Pune Escort, I provides a real, hot and intensely charitable sweetheart expertise, or I are often your engaging Escorts like in your imaginings.
    Pune Female Escorts Call Girls
    Bollywood Pune Female Escorts Call Girls

    I am not a shabby quite escort woman.. strive to not ought to meet any low category people, i would like to satisfy my category of type refined men thus thats why I frequently hoping to satisfy a distinguished individual World .
    High class Pune Female Escorts Call Girls

    ReplyDelete
  20. Hello Adam Barth your Blog is really nice and i read your full article but i want something more information about this article so please can you help me to send more information about this topic thank u so much
    Greengeeks Coupons

    ReplyDelete
    Replies
    1. vashikaran specialist
      http://www.lovervashikaranspecialist.com/

      Delete
  21. This comment has been removed by the author.

    ReplyDelete
  22. Vashikaran specialist Mk Shastri
    nice post really it is a very informative

    ReplyDelete
  23. This comment has been removed by the author.

    ReplyDelete
  24. Very good article, and did you know that there is a online.
    - Mortal Kombat XL
    - Atari Breakout
    - Dragon Ball Z Games

    ReplyDelete
  25. All the best blogs that is very useful for keeping me share the ideas
    of the future as well this is really what I was looking for, and I am
    very happy to come here. Thank you very much
    earn to die play
    earn to die
    earn to die 3
    Hi! I’ve been reading your blog for a while now and finally got the
    earn to die 4
    courage to go ahead and give youu a shout out from
    earn to die 6
    Austin Texas! Just wanted to tell
    earn to die 5
    you keep up the fantastic work!my weblog
    age of war
    Hi! I’ve been reading your blog for a while now and finally got the
    happy wheels

    tank trouble 3
    slither io
    slitherio

    ReplyDelete
  26. Excellent article, i really want to appreciate for this awesome post and opinion, Thanks for this great post.
    Jaipur Call Girls Service
    Dehradun Escorts
    Delhi Escorts Service
    Escort in Gurgaon
    Escort in Manali

    ReplyDelete
  27. All the best blogs that is very useful for keeping me share the ideas
    of the future as well this is really what I was looking for, and I am
    very happy to come here. Thank you very much
    earn to die
    earn to die 2
    earn to die 3
    Hi! I’ve been reading your blog for a while now and finally got the
    earn to die 4
    courage to go ahead and give youu a shout out from
    earn to die 6
    Austin Texas! Just wanted to tell
    earn to die 5
    Hi! I’ve been reading your blog for a while now and finally got the
    happy wheels
    strike force heroes
    slitherio
    you keep up the fantastic work!my weblog
    age of war
    earn to die 5
    good game empire

    ReplyDelete
  28. http://www.mikecann.net/2011/04/russia-to-allow-sale-of-cannabis.html?showComment=1464948982582#c7924054368822216747

    ReplyDelete
  29. This comment has been removed by the author.

    ReplyDelete
  30. Excellent post! I must thank you for this informative read. I hope you will post again soon. Warehousing of merchandise .
    While general look the things you ought to utilize little stockpiling zone space stockpiling range compartments to program the aides. Books get to be heavier when pressed 7 or more aides in a crate.
    Packers And Movers Chennai

    ReplyDelete
  31. I do have same issue on my website hanumanchalisalyrics.co.in can you please helm to resolve it ?

    ReplyDelete
  32. Nice to be visiting your blog again, it has been months for me. Well this article that i've been waited for so long. I need this article to complete my assignment in the college, and it has same topic with your article. Thanks, great share.
    dark souls 3 wiki emojis

    ReplyDelete
  33. It is one of the awesome site in my view as far as my knowledge is concerned about this kind website. Thanks for sharing!
    Packers and Movers Delhi
    Packers and Movers Noida

    ReplyDelete
  34. http://crawfordvspostollive.co/
    http://crawfordvspostollive.co/
    http://crawfordvspostollive.co/
    http://crawfordvspostollive.co/
    http://crawfordvspostollive.co/
    http://crawfordvspostollive.co/

    ReplyDelete