Re: Firefox PDF download - strange behaviour.

From	Andrei POPESCU <andreimpopescu@gmail.com>
Newsgroups	linux.debian.user
Subject	Re: Firefox PDF download - strange behaviour.
Date	2022-01-21 10:50 +0100
Message-ID	<DHYIp-4Kq-7@gated-at.bofh.it> (permalink)
References	(1 earlier) <DGiLg-63n-9@gated-at.bofh.it> <DGiLg-63n-5@gated-at.bofh.it> <DGsKC-4kR-1@gated-at.bofh.it> <DGHgC-5zu-5@gated-at.bofh.it> <DGZGy-ZZ-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Ma, 18 ian 22, 11:35:04, The Wanderer wrote:
> 
> Looking at that example, I note that it starts with the variable name
> "currentDirHandle". I think it's intended, although not explicitly
> stated, that the directory path specified in that function call is
> *relative*; that would let the API be used to create subdirectory trees
> underneath the user-chosen directory, but not outside of there.
> 
> So this could potentially be dangerous if the user chooses a directory
> location that's high enough in the directory tree to have important
> files already underneath it, but not if the user chooses e.g. a
> dedicated Downloads directory.
> 
> I can still envision scenarios in which this could be dangerous, but
> unless there are ways to get access to a file-handle variable that don't
> rely on something directly user-interactive (the ones described in that
> page are file-picker dialogs and "drag and drop a file into (a specific
> area of?) the browser window"), I don't think it can plausibly do so in
> a way that's invisible to the user.

This reminds me of 

https://arstechnica.com/gadgets/2021/07/separate-eop-flaws-let-hackers-gain-full-control-of-windows-and-linux-systems/

(the second part, with the Linux vulnerability)

Letting some random site have access to local storage seems like a Very 
Bad Idea.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: Firefox PDF download - strange behaviour. Kamil Jońca <kjonca@o2.pl> - 2022-01-16 19:50 +0100
  Re: Firefox PDF download - strange behaviour. songbird <songbird@anthive.com> - 2022-01-17 06:30 +0100
    Re: Firefox PDF download - strange behaviour. "Jeremy Nicoll" <jn.ml.dbn.25@letterboxes.org> - 2022-01-17 22:00 +0100
      Re: Firefox PDF download - strange behaviour. songbird <songbird@anthive.com> - 2022-01-18 06:00 +0100
        Re: Firefox PDF download - strange behaviour. "Jeremy Nicoll" <jn.ml.dbn.25@letterboxes.org> - 2022-01-18 15:50 +0100
          Re: Firefox PDF download - strange behaviour. David Wright <deblis@lionunicorn.co.uk> - 2022-01-18 17:50 +0100
          Re: Firefox PDF download - strange behaviour. songbird <songbird@anthive.com> - 2022-01-18 17:50 +0100
            Re: Firefox PDF download - strange behaviour. Vincent Lefevre <vincent@vinc17.net> - 2022-01-18 19:30 +0100
          Re: Firefox PDF download - strange behaviour. Curt <curty@free.fr> - 2022-01-19 13:50 +0100
      Re: Firefox PDF download - strange behaviour. The Wanderer <wanderer@fastmail.fm> - 2022-01-18 17:40 +0100
        Re: Firefox PDF download - strange behaviour. "Jeremy Nicoll" <jn.ml.dbn.25@letterboxes.org> - 2022-01-18 17:50 +0100
        Re: Firefox PDF download - strange behaviour. Andrei POPESCU <andreimpopescu@gmail.com> - 2022-01-21 10:50 +0100

csiph-web