@mathias The question more or less is what ISN’T a security problem about Flash.
-
-
- End of conversation
New conversation -
-
-
@mathias@photonstorm SWF is a client, you never compile compromised data in a client. -
@alesys_net Did you read the post? In this case, the user-controlled data is in a JSON-P endpoint. +@photonstorm
End of conversation
New conversation -
-
-
@mathias uh. jsonp is by definition a security problem. you're literally injecting arbitrary code already. sounds like fud to me. -
@kuvos By itself, JSON-P is not a security problem if you only allow alphanumeric characters. - 1 more reply
New conversation -
-
-
@mathias The real problem here is ignoring the Content-Type header and treating text as SWF. Who is doing that, the browser or Flash? -
@mathias Closest bug I could find was https://bugzilla.mozilla.org/show_bug.cgi?id=392459 … /cc@Nephyrin@dveditz - 1 more reply
New conversation -
-
-
@mathias How are Twitter et al mitigating this (Flash/browser) security hole in their JSONP endpoints? -
@jruderman See the last paragraph of that article. Also, did you see http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/#comment-1474644551 …? +@mikispag - 1 more reply
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
JavaScript, HTML, CSS, HTTP, performance, security, Bash, Unicode, i18n, macOS.