Stealing private documents through a bug in Google Docs

Re:Stealing private documents through a bug in Google Docs by cramforce on Monday December 28, 2020 @11:24AM (#25560430)

For legacy reasons the location object is special (you can write to it which is a proxy to writing to `location.href`). Some details here https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...

This is actually quite difficult to protect against while keeping functionality intact (not granting allow-scripts to iframes would do it, but also obviously disable JavaScript).

The emerging https://github.com/dtapuska/documentaccess standard would be a defense-in-depth against this attack.

[ Parent | on HN ]

Re:Stealing private documents through a bug in Google Docs by twiss on Monday December 28, 2020 @11:44AM (#25560627)

Myeah. I was aware that `WindowProxy.location` exists, but not that `WindowProxy.frames` exists. To me, that's the more surprising part - as `window.frames[0].location` should indeed be writable, but I feel like accessing `window.frames[0].frames` is more debatable - even knowing the number of iframes in a page might leak information in certain cases.

[ Parent | on HN ]