W3C CSS Validator - Proxying Attack

http://www.securiteam.com/securitynews/5GP0E1P8AK.html

Fixed:
http://dev.w3.org/cvsweb/2002/css-validator/org/w3c/css/util/HTTPURL.java
[[
	    int port = url.getPort();
	    String protocol = url.getProtocol();
	    String file = url.getFile();

	    if (((port < 1024) && (port != 80) && (port > 0))
		|| (!"http".equalsIgnoreCase(protocol))
		|| ((file != null) && (file.indexOf('\n') != -1))) {		
		System.err.println( "[WARNING] : someone is trying to get the file: "
				    + url );
		throw new FileNotFoundException("import " + url +
						": Operation not permitted");
	    }
]]

Server restarted so if the french network works, you should be able to
validate your CSS documents again.

Philippe

Received on Wednesday, 18 September 2002 16:12:14 UTC