Re: [webappsec] straw man anti-clickjacking proposal

On Mon, Mar 5, 2012 at 3:50 PM, Giorgio Maone <g.maone@informaction.com>wrote:

> On 28/02/2012 11:30, David Lin-Shung Huang wrote:
>
> > I assumed that ClearClick intends to detect any visible obstruction on
> > the clicked frame (a Twitter button in the test page), but saw that it
> > didn't detect the Flash movie on Windows.
>
> The promised work-around is included in latest development build,
> 2.3.3rc3 from http://noscript.net/getit#devel -- thank you, David.
>

Nice patch :)


> On a side note, I noticed http://webperflab.com/david/test/obscure.html
> suggests the bypass was due to 'wmode="direct" overriding z-index', but
> as I said in my previous message the cause was Gecko's
> canvas.context2.drawWindow() implementation failing to render windowed
> Flash applets. As far as I can see, in facts, the z-index is honored
> anyway: the demo page just forgot to set absolute or relative
> positioning on the "victim" frame, which otherwise would have been on top.
>

Good catch. I think my point is still valid though, I see that wmode=direct
does bypass z-index on my IE9 & Safari (Win7). (It might also bypass
z-index on older versions of Firefox.. if I remember correctly.)

Thanks,
David


> -- G
>