35

Using eval in this context doesn't create any vulnerability, as long as an attacker can't interfere with the arguments passed to matchCondition. If you find it easier to read / program it this way, and you're confident that no untrusted input will ever go into your expression compiler, then go for it. eval isn't evil, untrusted data is. Please note that ...


31

Today, everything is written by developers. Next month or next year, someone will say "hey, why not let the users write those themselves?" Bam. Also, even if the rules are written by the developers only, do they or will they include any user-originated data? Something like titles, names, categories, for instance? This could quickly lead to an XSS attack. ...


15

On eu-store.wacom.com, some images from their Amazon CDN are requested over http instead of https. This can be solved by installing HTTPS Everywhere and turning on "Encrypt All Sites Eligible": The gray padlock means all resources are served securely. So the webstore is most likely not compromised. They are still using an outdated cipher based on CBC and ...


8

My questions are, why is this inconsistency happening This is known as mixed-content,where the page is loaded with HTTPS,while some parts(images) are loaded via Insecure HTTP. how can I verify that the store page is indeed wacom's As long as your system has not been compromised then the only way is to use HTTPS everywhere and visit the correct URL or ...


5

On eu-store.wacom.com, some images from their Amazon CDN are requested over http instead of https Let me continue from that. Firefox says it's not 100% secure because it's loading unprotected content. I would say, naively... it's 95% secure Now, it doesn't mean the site wacom.com is not legitimate, but perhaps misconfigured. If you buy today from that site,...


5

Appearances and expectations If something looks like a safe expression, people will probably treat it like one. If a field looks like any other data-field, people (even developers) will probably put untrusted data in there. If something is evaluated with full level application access, it should look and feel like code. Another problem are subtle bugs in ...


4

I assume you are asking if you (the user NH) should trust a browser's built-in password manager, or if you should install a third party plugin; and not whether or not Mozilla should develop another password manager. Before I get started, keep in mind that security isn't just about vulnerabilities or architecture or protocols or passwords; it's an overall ...


4

I'll confess to not having any practical experience with keyloggers, but I don't see why a keylogger would care about the title of a web page, or would monitor DNS or TCP traffic. What's the point? Filtering based on the title of a page is not terribly useful: sure, a keylogger would be more interested in a page that's called “login”, but on many sites login ...


3

Front-end javascript itself is completely at the will of the client running the code. If you are depending on front-end javascript for security, you've already failed to secure your application. Forget eval. The client can replace your entire website with their own implementation if they desire. Thus, your server should validate everything that the ...


2

It's a kind of X-Y-problem. If you let untrusted software run on your computer, you have lost. Especially if it runs with administrative privileges. How can you tell that there's no DNS redirection going on, if you have a process running with administrative privileges? Can you at that stage trust your operating system to tell you? No, you can't. The ...


2

Usually browsers don't actually detect the phishing page but rather use a blacklist of URL's provided by services such as PhishTank or OpenPhish. While some of the websites posted in these lists are provided by programmed detectors, most are reported by users. The Chrome browser will use Google's large phishing DB compiled from Gmail reporting and other ...


1

As others have said, as long as your rules really are coming only from trusted developers, there shouldn't be any security holes from using eval. However, eval has plenty of other disadvantages, in terms of complexity, maintainability, debuggability, etc. And using regular expressions plus eval could easily result in problems down the road, depending on how ...


1

Keyloggers tend to capture control sequences, like tabs and clicks. So the keylogger can dump anything longer than 30 chars without a control sequence, for instance, as not being interesting. But keyloggers also tend to be context-aware. Switching to new windows, for instance. They can look for entry into password fields, especially if you are talking about ...


Only top voted, non community-wiki answers of a minimum length are eligible