258 reputation
210
bio website
location
age
visits member for 2 years
seen Jun 26 at 1:26

Sep
10
awarded  Notable Question
May
26
awarded  Nice Question
Apr
29
awarded  Popular Question
Nov
6
awarded  Popular Question
Sep
27
awarded  Yearling
Apr
9
comment Implication of URL injection in an URL shortener service
I'd like to point out that I find it very very sad that most questions here gets answered with, basically: "This is a solved problem, it's very easy to do a, b and c to dodge exploit x, y or z", Yet we're seeing exploits exploiting trivial security holes daily. So it would be nice if the mindset of security-aware people would change from: "It's easy, all you need is to parse/sanitize/etc." to a more open-minded and pro-active way of thinking...
Apr
9
revised Implication of URL injection in an URL shortener service
added 665 characters in body
Apr
9
comment Implication of URL injection in an URL shortener service
regarding the Google safe-browsing, there's a serious misunderstanding here: I'm not very concerned about what the URL contains here (not that it's not a valid concern, but it's something else altogether), I'm concerned about the URL itself doing something nasty to my users when they're visiting my site, not when they're visiting the target URL.
Apr
9
comment Implication of URL injection in an URL shortener service
"...and the database query to save the mapping" There has to be a database query anyway to save the URL. Doesn't change anything if I'm saving the bit.ly mapping URL or the direct URL in my DB. : ) I agree that there's a price to pay for the call to the URL shortener: that's the price for added security.
Apr
9
comment Implication of URL injection in an URL shortener service
"The only security you would get from an external URL shortening service is that they will only shorten valid URLS, and not javascript code etc." But that's kinda precisely the whole point. That's quite an added security: when the latest URL injection comes out, my site ain't affected and it's the URL shortening service that needs to patch his webapp service, not me. Once again: this is not incompatible with other measure, like calling Google's safe-browsing API (also, if you call calling an URL shortener 'inefficient', I wonder what you call calling Google's verification API ; )
Apr
9
comment Implication of URL injection in an URL shortener service
"This is an inefficient way of doing things."... There are only so much URLs an user can submit and all it takes for me is to call the URL shortening service once and saving that result/mapping in my DB. What's innefficient about this?
Apr
9
comment Implication of URL injection in an URL shortener service
I think there's a misunderstanding: whatever URL the user sends, that URL first gets send by my webapp to the URL shortening service and then when I'm generating the pages to be served containing the URL the user "inputed", well, I'm not really serving back that URL. I'll only ever be serving URL starting with, say, bit.ly and then adding at most nine alphanumeric characters. I don't care where the URL the user inputs comes from: it shall go through the URL shortening service no matter what and it's the result from the URL shortening service that I shall display on my site.
Apr
9
revised Implication of URL injection in an URL shortener service
added 192 characters in body
Apr
9
comment Implication of URL injection in an URL shortener service
I know about OWASP, it's precisely why I'm looking for additional measure against, say, XSS. What I'm trying to determine is if in this case XSS would still be my problem or not. :-/ (I'll edit to reflect that)
Apr
9
awarded  Commentator
Apr
9
comment Implication of URL injection in an URL shortener service
I could throttle user inputs so that I don't hammer the URL shortening service and I take it that the URL shortening service is acting in good faith. I haven't heard URL shortening services returning bad URLs on purpose :-/ Basically what I'd like to understand are the XSS / CSRF and other security implication should security be correct on my site but an exploit able to bypass the URL shortener's security (I'm not that concerned about the URL shortener being itself a rogue site but even if that service was fully hacked/rooted, what would be the implication for my site?).
Apr
9
revised Implication of URL injection in an URL shortener service
added 131 characters in body
Apr
9
revised Implication of URL injection in an URL shortener service
added 1 characters in body
Apr
9
asked Implication of URL injection in an URL shortener service
Mar
29
awarded  Critic