Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This JPEG is also a webpage

lcamtuf.coredump.cx

Post reply on HN
Print view View original

201–210 of 236 posts

Re: This JPEG is also a webpage

#201

Post by int_19h »

TazeTSchnitzel wrote: post #147
Houshalter wrote: post #143

Earlier quoted context omitted.

There's nothing wrong with some tolerance, like ignoring tags that it doesn't know. But if the syntax is wrong, it shouldn't try to fix it or guess what the user meant, just display an error. Accepting invalid syntax means all HTML parsing becomes vastly more complicated. Which creates room for bugs, exploits, and unexpected situations like OP's post.

> But if the syntax is wrong, it shouldn't try to fix it or guess what the user meant, just display an error. Accepting invalid syntax means all HTML parsing becomes vastly more complicated. Why push the complexity onto the user? Someone who just wants to make a working website doesn't care about your pedantry. Do they want their page to fail to render entirely when PHP outputs a warning? Do they want their website t…

>> Why push the complexity onto the user? Someone who just wants to make a working website doesn't care about your pedantry.

Because this approach has historically resulted in people who "just wanted to make a working website" making websites that only work in specific browsers (or worse yet, specific versions of specific browsers on specific platforms). And then those sites stuck around and infrastructure got built around them that made them hard to fix.

We've spent the best part of 00s fixing that mess, and there are still some pockets that haven't been properly cleaned up. If that's not a lesson to learn from, I don't know what is.

Re: This JPEG is also a webpage

#202

Post by gcb0 »

slice-beans wrote: post #155
alanh wrote: post #116

Earlier quoted context omitted.

Well now, that is interesting… deep packet inspection? or just a truly insane bug? What router is it?

Here's the request and response from router: http://pastebin.com/e7rxLsGJ The router itself is a BT Internet (UK) branded one. Not sure of the exact model but I'll try to find out...

the fact that it encodes "/" on a part of the url in a parameter, but not on another is a very good indication that whatever this 'feature' is doing is badly thought out and the implementation was done by the intern.

Re: This JPEG is also a webpage

#203

Post by kalleboo »

rcthompson wrote: post #122

I wonder if browsers are smart enough to only download the file once for the html and then cache it for the embedded image.

It looks like Safari is at least, and it even de-duplicates it in the Web Inspector so it only lists a single resource (which gets listed as "type: image"

Re: This JPEG is also a webpage

#204

Post by dpark »

JimDabell wrote: post #164
dpark wrote: post #153

Earlier quoted context omitted.

> It's not. There are two areas where the leniency was a problem here. Firstly, the leniency in rendering one media type as a completely different media type because the browser heuristic thought it was being lenient. Secondly, the leniency in parsing HTML out of an image file – you can't do that with valid HTML. I think you can argue the first is a problem. You have an example demonstrating as much. Arguing that the…

> Arguing that the second is a problem is much harder. Lenient HTML acceptance been hugely advantageous to the adoption of the web. Wait, that's a completely different point. The argument here is that it caused a security vulnerability, and it did. If the lenient HTML parser didn't try to salvage HTML out of what is most certainly not valid HTML, then it wouldn't be a security vulnerability. > This seems amazingly sh…

You have some compelling examples of problems from leniency. I think in some cases the issues are definitely magnified by other poor designs (bad escaping/filtering) but you've demonstrated that well-intentioned leniency can encourage and even directly cause bugs.

Thanks for providing actual, concrete examples.

Re: This JPEG is also a webpage

#205

Post by thomasfoster96 »

kalleboo wrote: post #203
rcthompson wrote: post #122

I wonder if browsers are smart enough to only download the file once for the html and then cache it for the embedded image.

It looks like Safari is at least, and it even de-duplicates it in the Web Inspector so it only lists a single resource (which gets listed as "type: image"

Yep, Safari doing the same for me. Although I'm seeing it as an image with type "text/html", which is odd.

Re: This JPEG is also a webpage

#208

Post by 286c8cb04bda »

TazeTSchnitzel wrote: post #148
chriswarbo wrote: post #43

Earlier quoted context omitted.

Data URIs are useful for embedding resources in a page (e.g. a single HTML file containing all of its own CSS, JS, images, etc.) This is different: it's a single file which can be parsed as either a HTML page or a JPEG. Hence, when a program expects a HTML page (like a browser loading a Web page), it will be parsed and displayed as a HTML page. When a program expects a JPEG file (like a browser loading the "src" of a…

I think it may only work if you omit a Content-Type header. Checking Firefox's Network tab, it looks like the server isn't serving one for that page.

It's sending the "wrong" one --

    $ curl -I http://lcamtuf.coredump.cx/squirrel/
    HTTP/1.1 200 OK
    Date: Thu, 11 Aug 2016 05:18:00 GMT
    Server: Apache
    Last-Modified: Mon, 19 Sep 2011 23:31:49 GMT
    Accept-Ranges: bytes
    Content-Length: 135938
    Content-Type: text/html

Re: This JPEG is also a webpage

#210

Post by neom »

slice-beans wrote: post #171
fosk wrote: post #157

Earlier quoted context omitted.

Besides the model number, can you also tell us the firmware version?

BT Home Hub 5 (Type A) Software version 4.7.5.1.83.8.204.1.11 But, false alarm anyway, nothing interesting is happening. The firmware had updated and reset parental control settings on the router. The domain is on some blacklist apparently so it was redirecting to a page to finalise parental control preferences. Sorry it wasn't any more interesting than that. Edit: the reason it took me a while to figure this out was…

So how did you figure it out?
Post reply on HN