Path: csiph.com!fu-berlin.de!uni-berlin.de!not-for-mail
From: Chris Angelico <rosuav@gmail.com>
Newsgroups: comp.lang.python
Subject: Re: Speaking of Javascript [was Re: Everything good about Python except GUI IDE?]
Date: Thu, 3 Mar 2016 07:55:32 +1100
Lines: 35
Message-ID: <mailman.114.1456952134.20602.python-list@python.org>
References: <64a6599c-fae1-469d-bcee-875165b3cc7d@googlegroups.com> <mailman.172.1456574862.20994.python-list@python.org> <56d294f8$0$1604$c3e8da3$5496439d@news.astraweb.com> <naupig$upg$1@dont-email.me> <234a398e-1b0f-467b-a8cb-d7ca748f8062@googlegroups.com> <naur90$58b$1@dont-email.me> <84922f24-3e00-4a23-b26d-5e6c0d8e7e04@googlegroups.com> <87y4a5c58i.fsf@elektro.pacujo.net> <e805ec03-82dd-40bc-9a44-344620d435a9@googlegroups.com> <87twksdg9c.fsf@elektro.pacujo.net> <ioi7dbtldo5fej0i41gugcv0pa9pj04j58@4ax.com> <87d1rgca58.fsf@elektro.pacujo.net> <c0c563c0-1caf-4d3b-93f8-c62db864b5a3@googlegroups.com> <87h9grorcb.fsf@elektro.pacujo.net> <mailman.4.1456734787.20602.python-list@python.org> <56d5c6fa$0$1595$c3e8da3$5496439d@news.astraweb.com> <mailman.75.1456855654.20602.python-list@python.org> <56d64e83$0$1588$c3e8da3$5496439d@news.astraweb.com> <56d71d5f$0$1619$c3e8da3$5496439d@news.astraweb.com> <mailman.107.1456940817.20602.python-list@python.org> <slrnndece3.19u.jon+usenet@wintry.unequivocal.co.uk>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
In-Reply-To: <slrnndece3.19u.jon+usenet@wintry.unequivocal.co.uk>
Precedence: list
Xref: csiph.com comp.lang.python:103896

On Thu, Mar 3, 2016 at 5:29 AM, Jon Ribbens
<jon+usenet@unequivocal.co.uk> wrote:
> On 2016-03-02, Chris Angelico <rosuav@gmail.com> wrote:
>> To be fair, this isn't a JS exploit; it's a trusting-of-trust issue -
>> eBay has declared that you can trust them to sanitize their sellers'
>> listings, and so you trust eBay, but this exploit gets past the
>> filter.
>
> This is true. It sounds like their filter is frankly bizarre,
> I can't imagine why it works the way that has been described.

Agreed. I also don't understand why they can't simply say "no <script>
tags permitted". By the look of the error message, they've been
playing whack-a-mole with exploits as they're found, rather than
actually designing for security.

>> You're no more vulnerable looking at one of those listings
>> than you would be going to a web site entirely controlled by the
>> attacker, save that (particularly on mobile devices) there are a lot
>> of people out there who'll say "Oh, it'e eBay, I'm safe".
>
> This however I don't think is true at all. eBay already has a great
> deal of data about its customers, if an attacker can hijack sessions
> and steal this data just from a user visiting a listings page then
> that isn't anything like visiting a random malicious site.

Hmm, maybe. But the description of the exploit talks of getting people
to click a button to install an app, which is something anyone could
do with full control of a web site; the value (to the attacker) of
exploiting the eBay filter limitation is that it slips it into an
otherwise-trusted web site (both from the human's point of view -
"this is eBay, it's fine" - and from a machine filter's - "yes, this
is the same site you thought you were on").

ChrisA