… and I show you an unguarded
- The Facebook Widget accesses about a dozen facebook APIs through JSON. It’s based on the facebook JS Library. And guess what the parseJSON routine in that library really is? This widget runs with the
AllowFullAccessconfiguration option set.
- The Flickr Interestingness widget is another culprit. This one only runs with the
AllowInternetPluginsflag; if subverted, it might give an attacker access to, say, the latest Quicktime hole. Don’t think it’s enough to secure your browser.
- The Hockey Widget doesn’t do JSON; instead, it loads some web page and parses an embedded script by, you guess it, feeding it to
eval(), after some minor searching and replacing.
The bad teaching award of the day goes to the AOL Xdrive developer documentation: The Open XDrive Usage Meter of course accesses XDrive through JSON, and of course it uses
eval() to parse. It has a sibling Windows Vista sidebar gadget; same problem. By the way, the security model for these gadgets gives access to ActiveX controls that are not marked “safe for scripting”.Questions?