Subject: [Tools-discuss] The Internet Draft posting tool should not allow URLs in any fields

From: Paul Hoffman <[email-masked]>
Date: Tue, 22 Jan 2008 12:31:33 -0800

Greetings again. This morning, a new Internet Draft was posted that 
had a full URL (scheme included) in its title. This is clearly bad 
because these get posted to the Internet Drafts archive. This could 
lead to a cross-site scripting attack on the IETF web site.

Proposal: the draft submission tool should remove the scheme from any 
URL it sees in any field that might get posted to an official IETF 
mailing list. This means scrubbing the title, author, filename, 
pages, date, and abstract. (Yes, we should not assume that someone 
won't be tricky and, after posting a draft, change what is sent back 
to have a link around the page count that could be used as an attack 
vector.)

--Paul Hoffman, Director
--VPN Consortium

_______________________________________________
Tools-discuss mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tools-discuss

---

From: "Roy T. Fielding" <[email-masked]>
Date: Tue, 22 Jan 2008 13:16:15 -0800

> lead to a cross-site scripting attack on the IETF web site.

No, it can't.  A URL is just plain text.  In any case, the IETF website
has no privacy-sensitive services that would be vulnerable to cookie
authentication being stolen via XSS on broken browsers.

> Proposal: the draft submission tool should remove the scheme from  
> any URL it sees in any field that might get posted to an official  
> IETF mailing list. This means scrubbing the title, author,  
> filename, pages, date, and abstract. (Yes, we should not assume  
> that someone won't be tricky and, after posting a draft, change  
> what is sent back to have a link around the page count that could  
> be used as an attack vector.)

What the tool should remove is angle brackets and anything that
looks like UTF-7 encoding.  Regular text that is only used in
text fields is no danger whatsoever.

....Roy

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 22 Jan 2008 13:25:47 -0800

At 1:16 PM -0800 1/22/08, Roy T. Fielding wrote:
>No, it can't.  A URL is just plain text.

True, but it was presented in the archive as a live link. See 
<http://www1.ietf.org/mail-archive/web/i-d-announce/current/msg18520.html>. 
It was also

>In any case, the IETF website

...yet. Assuming that we will never have such services seems 
optimistic, or short-sighted, or both.

>looks like UTF-7 encoding.

That would be good as well.

>Regular text that is only used in

...unless one of the other tools, like the list archiver, turns 
things that look like URLs into URLs. Which our mail archiver does.

--Paul Hoffman, Director
--VPN Consortium

---

From: "Roy T. Fielding" <[email-masked]>
Date: Tue, 22 Jan 2008 15:07:29 -0800

On Jan 22, 2008, at 1:25 PM, Paul Hoffman wrote:

>>> Greetings again. This morning, a new Internet Draft was posted  
>>> that had a full URL (scheme included) in its title. This is  
>>> clearly bad because these get posted to the Internet Drafts  
>>> archive. This could lead to a cross-site scripting attack on the  
>>> IETF web site.
>>

An anchor href is not a source of XSS.

> optimistic, or short-sighted, or both.

XSS attacks are the purest form of bullshit security on the net -- they
make servers run around and "fix" what would otherwise be normal data
display based on the theory that some broken browser and some insecure
security mechanism can be used in combination to fool a user into
revealing sensitive information across sites.  The vast majority of
such reports are just nonsense.  If you can't show a specific
attack vector that works by inserting text into the Title, then
asking the tools group to change the titles is a BAD IDEA.

> things that look like URLs into URLs. Which our mail archiver does.

Then fix the mail archiver, if it needs to be fixed.  What specific
attacks are enabled by adding an anchor to a URI reference?  Using
the text in other attributes would, but not in anchor href.

....Roy

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 22 Jan 2008 16:24:39 -0800

>asking the tools group to change the titles is a BAD IDEA.

OK, so if folks on these two lists agree with Roy about this, feel 
free to ignore my initial request.

--Paul Hoffman, Director
--VPN Consortium