News for hackers. Stuff that matters.
Re:Do Not Type "File:///" in OS X by 0x0 on Friday February 01, 2013 @09:33PM (#5154877)
From the openradar bug, it is obvious that the bug is inside the "Data Detectors" thing. Looks like it triggers on anything starting with file:// (+/) case-insensitive, but then something later in the data extraction makes the incorrect assumption that the string should start with file:// (+/) lowercase, and throws an assert.

It's really quite bad that a bug inside the data detectors can bring down a whole app.

Edit: some interesting links:

http://support.apple.com/kb/PH4519 ("This feature is called “data detectors.”")

https://developer.apple.com/library/mac/#documentation/Found...

Re:Do Not Type "File:///" in OS X by nikcub on Saturday February 02, 2013 @04:30AM (#5155611)
checkDataDetectors will extract 'File://a/' - or any other 'complete' file URL - which at a minimum is a schema (file://) and a path '/' - as a valid data URL and then pass it to DDResultCopyExtractURL, which does some additional sanity checking.

There it validates it by asserting that the URL begins with 'file://', which it doesn't. It then converts to an NSInternalInconsistencyException which is what crashes the application, since it isn't caught.

The timing differences that people are seeing is because the NSSpellCheckerCheckString process checks the spelling only after your key entry has been idle for a short period.

checkDataDetectors will also run if you simply open a file or application with this text inside it in a text control. When declaring your text control class you can disable the automated spell checking and data extraction (which will run even if you have spell checking disabled).

There really is no need for this thread to be filling up with 'it works on x, doesn't work on y', since we know what causes this (any NSTextField on Mountain Lion).

If you want to have a look at it and can't read the crash report, attach to TextEdit with gdb

    $ gdb /Applications/TextEdit.app/Contents/MacOS/TextEdit
    (gdb) r
    <switch to textmate and type 'file://a/aaaaa' into a new doc'>
    (gdb) <crash report>
    (gdb) disass DDResultCopyExtractedURL
    <dump of function>
Also, this means the bug can't be exploited
Re:Do Not Type "File:///" in OS X by codeka on Saturday February 02, 2013 @06:18AM (#5155763)
What do you mean "exploited"? It certainly can be exploited to cause a denial of service (like the one at this page: http://gironda.org/this_will_crash_safari.html).
Re:Do Not Type "File:///" in OS X by nikcub on Saturday February 02, 2013 @07:32AM (#5155856)
'exploit' is the term for getting a bug to run your own shellcode
Re:Do Not Type "File:///" in OS X by thefreeman on Saturday February 02, 2013 @10:02AM (#5156108)
Can you clarify what about that output shows that the crash cannot be exploited? Not doubting, just curious.
Re:Do Not Type "File:///" in OS X by pcwalton on Saturday February 02, 2013 @01:57PM (#5156890)
Unhandled exceptions can't be exploited in general, because they safely unwind the stack and terminate the application. This crash is just an unhandled exception. By contrast, a segfault (at an address other than NULL) would be more interesting from a security perspective.
Re:Do Not Type "File:///" in OS X by thefreeman on Sunday February 03, 2013 @12:17PM (#5160244)
thank you sir!
Re:Do Not Type "File:///" in OS X by X-Istence on Friday February 01, 2013 @10:34PM (#5155035)
The data detectors, at least in my TextEdit were turned off (never touched it before) so typing the aforementioned string doesn't cause any issues.

However in my stupidity of attempting to tell you guys that I could type the aforementioned string, I caused Safari to hang. No crash, but it was complete and utterly useless.

Re:Do Not Type "File:///" in OS X by X-Istence on Friday February 01, 2013 @10:41PM (#5155055)
Nevermind ... re-ran TextEdit and tried again, immediately crashes. data detectors are still turned off.
Re:Do Not Type "File:///" in OS X by MBCook on Friday February 01, 2013 @10:54PM (#5155087)
Perhaps that preference only suppresses the display, but the data detectors still run.
Re:Do Not Type "File:///" in OS X by pifflesnort on Saturday February 02, 2013 @01:53AM (#5155417)
Another link, with disassembly and a patch: https://twitter.com/landonfuller/status/297592929923502080