Michael Tsai
Sparkle Updater Vulnerability: http://mjtsai.com/blog/2016/02/02/sparkle-updater-vulnerability/ … #mjtsaiblog
-
@rosyna What I meant by that is, why is WebKit executing any non-JavaScript code?
Rosyna Keller
@mjtsai It's passing it to LaunchServices (as WebKit does for other protocol handlers). Quarantine normally prevents execution.
-
-
@rosyna I get that, but I don’t understand why I would want my browser to be able to do that silently, especially via JavaScript. -
@mjtsai You wouldn't want your browser to. But you do want WebKit to be able to do so. It's used in app documentation. -
@mjtsai Well, you'd want WebView to do it. -
@mjtsai And WebViews have a method to change this behavior https://developer.apple.com/library/mac/documentation/Cocoa/Reference/WebKit/Protocols/WebPolicyDelegate_Protocol/#//apple_ref/occ/instm/NSObject/webView:decidePolicyForNavigationAction:request:frame:decisionListener …: that Sparkle overrode (https://github.com/sparkle-project/Sparkle/commit/70f6929ac766b404e8e0d28d5cbda7872dc2ee3f …) -
@mjtsai Err, that was supposed to link to -webView:decidePolicyForNavigationAction:request:frame:decisionListener: -
@mjtsai That is, Sparkle was *explicitly* opening every file using LaunchServices by overriding the default WebView handler. -
@rosyna Thanks for that link.
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
RT