Re:NTFS bug lets anyone hang or crash Windows 7 or 8.1
by jordache on Friday May 26, 2017 @11:41AM
(#14424832)
browsers implement cross domain origin policy to prevent js from accessing the local filesystem. Or did I misunderstand the nature of the Windows bug. It must be trying to read from file:// right?
[ Parent
| on HN ]
Re:NTFS bug lets anyone hang or crash Windows 7 or 8.1
by blockoperation on Friday May 26, 2017 @03:14PM
(#14426450)
Resources/frames/XHRs/etc from 'file://' might be blocked, but what about top-level redirects?
At the very least, user-initiated top-level navigations should bypass any policies. If you're out to cause mischief, you could just link to the dodgy path on forums/comments/etc – there'll always be people out there who are careless and/or clueless enough to click on it.
Re:NTFS bug lets anyone hang or crash Windows 7 or 8.1
by komali2 on Friday May 26, 2017 @12:21PM
(#14425164)
<img src="c://badfilename"> is enough. You don't need JavaScript.
Re:NTFS bug lets anyone hang or crash Windows 7 or 8.1
by deelowe on Friday May 26, 2017 @01:23PM
(#14425714)
But you do need the file to be stored locally. I don't think this attack is very serious. Downloading and opening files is already a risky maneuver.
Re:NTFS bug lets anyone hang or crash Windows 7 or 8.1
by komali2 on Friday May 26, 2017 @03:59PM
(#14426726)
My understanding of the article is there isn't a "local file" that matches the name, but the very act of checking for that filename causes the hang.
Happy to be corrected.