Re: SVG 1.2 Tiny: Networking API issues

Hello www-svg,

Jeff Schiller <codedread@gmail.com> wrote:
  
> I'm no security expert, but what about a script that requests a
> connection to the localhost on various ports (i.e. FTP 21, etc) and
> sniffs about the local host, then sends the data it finds back to the
> server through standard ports? Would that effectively open up your
> computer by bypassing any firewall since the "attack" would come from
> within the localhost browser or do firewalls watch for that sort of
> thing too?

There are a number of different security models that might be used by
different types of svg implementations. For example, a closed
implementation used as a user interface, which cannot accept arbitrary
content, might have one set of requirements. A military application
might have different requirements.

In web browsers, a common model is to prohibit cross-domain
communication. So if the content was loaded from some domain X, it can
only talk to X. Localhost is a different domain under that model.

In the past, some browsers special-cased localhost and assumed that
localhost content is always trusted. Nowadays though it tends to be
treated like any other domain. Thus in the scenario you propose, a
cross-domain security model would forbid the localhost attack that you
mentioned.

(Note that the firewall would not be able to detect local content
accessing localhost; it probably does not even use network loopback. )

-- 
 Chris Lilley                    mailto:chris@w3.org
 Chair, W3C SVG Working Group
 W3C Graphics Activity Lead
 Co-Chair, W3C Hypertext CG

Received on Thursday, 2 March 2006 14:39:56 UTC