[41352] in bugtraq
Re: XSS on Yahoo Mail
daemon@ATHENA.MIT.EDU (Jim Ley)
Sat Nov 26 09:05:07 2005
To: bugtraq@securityfocus.com
From: "Jim Ley" <jim@jibbering.com>
Date: Thu, 24 Nov 2005 19:28:45 -0000
Message-ID: <dm54a5$qs1$1@sea.gmane.org>
X-Complaints-To: usenet@sea.gmane.org
"Will Wesley" <willwesleyccna@yahoo.de> wrote in message
news:20051124025004.32883.qmail@web26902.mail.ukl.yahoo.com...
>This is not exactly a problem with Yahoo!, but rather
>a problem with the way browsers tend to render HTML
>when forced to deal with broken tags.
So it's a problem with Yahoo, as they allow the email, to write to places on
the screen that is not part of the email. I agree this is certainly down to
the liberalness of the browsers parser, but that doesn't mean yahoo can
ignore it, it's just a demonstration of how difficult a job it is for people
who want to accept arbitrary HTML to be secure for their user
Of course there is a pretty simple solution, which is to just use an IFRAME,
then there's no way the email to escape into the surrounding chrome.
Jim.
