Firefox Browser URL Spoofing Vulnerability

  • Thread starter Thread starter R. L.
  • Start date Start date
Here's another attempt:

1. Install the Adblock Firefox extension.

2. Look at the Adblock 'Preferences' and go to 'Adblock Options'

3. Tick 'Site Blocking'

4. Add the following filter :-

/[^\x20-\xFF]/
 
Here's another attempt:

1. Install the Adblock Firefox extension.

2. Look at the Adblock 'Preferences' and go to 'Adblock Options'

3. Tick 'Site Blocking'

4. Add the following filter :-

/[^\x20-\xFF]/
Click to expand...

Maybe I'm just dense, but how does that differ from your previous
instructions? My question regarding the dash immediately following the
colon in step 4 still applies. (And apologies for mis-typing your name
in my other post).
 
Here's another attempt:

1. Install the Adblock Firefox extension.

2. Look at the Adblock 'Preferences' and go to 'Adblock Options'

3. Tick 'Site Blocking'

4. Add the following filter :-

/[^\x20-\xFF]/
Click to expand...

Maybe I'm just dense, but how does that differ from your previous
instructions? My question regarding the dash immediately following the
colon in step 4 still applies.
Click to expand...

It's just

/[^\x20-\xFF]/

No colon and no dash.
(And apologies for mis-typing your name in my other post).
Click to expand...

No problem. I'm used to it. :o)
 
Iain said:
Here's another attempt:

1. Install the Adblock Firefox extension.

2. Look at the Adblock 'Preferences' and go to 'Adblock Options'

3. Tick 'Site Blocking'

4. Add the following filter :-

/[^\x20-\xFF]/
Click to expand...

Great fix! It seems to work very well, just so one ignores Iain's ":-"
preceding the actual filter :-)

Daze
 
The voice of "EA" drifted in on the cyber-winds,
from the sea of virtual chaos...
One more thing: the filter should not match the "http://" portion
of the address. Also, what if the link does not have the "http://"
part (i.e., href="www.site.com")? How would you negate "http://"
in the match expression?
Click to expand...


Take a bigger slice...

Bounds = "<a\s*>"
Match = "*href=(https?://)?[^/]++\&*"

That should make the "http://" part transparent to the test...
I'm running on my regex knowledge here, but it should still work. };8)
 
The voice of "EA" drifted in on the cyber-winds,
from the sea of virtual chaos...
One more thing: the filter should not match the "http://" portion
of the address. Also, what if the link does not have the
"http://" part (i.e., href="www.site.com")? How would you negate
"http://" in the match expression?
Click to expand...

Take a bigger slice...

Bounds = "<a\s*>"
Match = "*href=(https?://)?[^/]++\&*"

That should make the "http://" part transparent to the test...
I'm running on my regex knowledge here, but it should still work.
Click to expand...

Or now that I think about it some more...

*href=(["]?https?://)?[^/]++\&*

or perhaps...

*href=(*://)?[^/]++\&*

But I'm not sure if a "/" needs to be "escaped" or not.


(I need some sleep)
 
The voice of "EA" drifted in on the cyber-winds,
from the sea of virtual chaos...
One more thing: the filter should not match the "http://" portion
of the address. Also, what if the link does not have the
"http://" part (i.e., href="www.site.com")? How would you negate
"http://" in the match expression?
Click to expand...

Take a bigger slice...

Bounds = "<a\s*>"
Match = "*href=(https?://)?[^/]++\&*"

That should make the "http://" part transparent to the test...
I'm running on my regex knowledge here, but it should still work.
Click to expand...

Or now that I think about it some more...

*href=(["]?https?://)?[^/]++\&*

or perhaps...

*href=(*://)?[^/]++\&*

But I'm not sure if a "/" needs to be "escaped" or not.


(I need some sleep)
Click to expand...


Thank you!!

E.
 
/[^\x20-\xFF]/
Click to expand...
12344444444421

Just in the interest of people using this workaround knowing how it
works,

1 - The forward slashes just tell AdBlock that what is between them
is a regular expression.

2 - The brackets mark off the definition of a class of characters.

3 - The ^ is a NOT operator for the character class; i.e. the class
is defined to be all characters /except/ the ones that follow.

4 - \x20-\xFF are the class of characters with hex values between 20
and FF, inclusive.

So this filter blocks all sites with urls which contain any
character other than hex 20-FF.

I really don't see the IDN problem as a browser vulnerability. It's
a problem with the very idea of IDNs; when only ASCII domain names
were allowed, the characters were all easily distiguishable, but
with IDNs they are not. I don't know what permanent solution (other
than doing away with IDNs) might be possible. I suppose browsers
oculd pop up a warning whenever a domain name contains certain
characters, but that would be pretty annoying.

FWIW, the Verisign plugin for IE which allows it to browse IDNed
sites does not display IDNs properly, at least on my WinXp machine
with IE 6.0.2900.2180; this may or may not have been a "fix" in
response to concerns about spoofing or it may just be that I don't
have enough fonts installed for IE to use. Here's a screenshot of
IE displaying Secunia's test page:

<http://www.cotse.net/users/putty/images/IEIDN.png>

In case IE users want that free plugin, it is available at

<http://www.verisign.com/products-se...ces/internationalized-domain-names/index.html>

or <http://tinyurl.com/692yr>.

It phones home once a day for updates.
 
So this filter blocks all sites with urls which contain any
character other than hex 20-FF.
Click to expand...

Thanks Q.
I really don't see the IDN problem as a browser vulnerability. It's
a problem with the very idea of IDNs
Click to expand...

Well it certainly is a vulnerability as far as regular users are concerned.
 
Back
Top