the bug exists only by searching on the google homepage, searching it on the searchbar of the browser doesn't happen.
Break Google
41–50 of 92 posts
Re: Break Google
#42When you search for "${", the page is missing 26 lines of minified JavaScript (lines 9-35 of a non-broken page, at least for me), almost certainly because of a templating bug. These lines, among other things, are responsible for adding the top toolbar to the page. (The missing JS is here: http://pastebin.com/B9cy3T2c )
Can you tell us what tools you used to find all this info and to un-minify their js? thanks!
Re: Break Google
#43Earlier quoted context omitted.
This is actually a hard problem in the general case, and it is an active area of research. One promising approach is static taint analysis , wherein the source code of a web app is analyzed to detect whether "tainted" output is given to a sensitive "sink" without being properly sanitized. See, e.g., Omer Tripp et al., "TAJ: Effective Taint Analysis of Web Applications" (PLDI 2009) ( http://www.cs.tau.ac.il/~omertrip/…
That's a poor example. I would never send a document as HTML without tags. html_sanitize() should really be generate_html(), which adds structure to the document. What the GP is saying (and I agree with) is that generate_html() should use a library which understands HTML structure and only allows content to be generated using a strict API (no doc+=" bar " garbage). Such a discipline greatly reduces the chance of inje…
You don't know where "doc" is coming from from a snippet like that. I use logic moderately similar to that for my blog software. If I'm writing the blog post, pretty much pass through what I wrote. If it's a comment (back when I had them), process the heck out of it. The blog post itself is a blob of HTML, basically.
I do not currently write my blog posts in a templating language (any more than anyone else does), though Hamlet [1] has me sort of tempted as it is so close to what I write anyhow.
Re: Break Google
#44> Shortest way to produce issue is here — http://google.com/#q=${
Making it an actual hyperlink would've been a bit shorter.
Re: Break Google
#45Tip to the poster, and to anyone: Google (and Facebook, and others) have bug bounty programs. You can get paid tens to thousands of dollars if you report vulns to the vendor first.
Pretty low bounty. The base reward for qualifying bugs is $500. If the rewards panel finds a particular bug to be severe or unusually clever, rewards of up to $3,133.7 may be issued. http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w...
Even those bounties are only for security-related bugs, one of which this doesn't appear to be.
Re: Break Google
#46Oh, cute. Yet another injection flaw in Google. Guys, (and I don't mean Google, I mean all of us), don't fix injection by plugging injection bugs; put together some framework that actually avoids all of these problems (or at least doesn't let you add bugs).
Django does this.
How exactly?
Due to django's "we want the templating system be general, to be usable for stuff other than html", it can't provide support for such 'guarantee that the output is well formed / valid / has no injection attack entry points' features.
Re: Break Google
#47Oh, cute. Yet another injection flaw in Google. Guys, (and I don't mean Google, I mean all of us), don't fix injection by plugging injection bugs; put together some framework that actually avoids all of these problems (or at least doesn't let you add bugs).
Django does this.
No. Django solves the 90% problem, which is usually a fine approach but will llikely lead to security vulnerabilities down the line.
I'll refer to something I wrote last time I had this argument: http://pavpanchekha.com/programming/injection.html.
Re: Break Google
#48Oh, cute. Yet another injection flaw in Google. Guys, (and I don't mean Google, I mean all of us), don't fix injection by plugging injection bugs; put together some framework that actually avoids all of these problems (or at least doesn't let you add bugs).
This is actually a hard problem in the general case, and it is an active area of research. One promising approach is static taint analysis , wherein the source code of a web app is analyzed to detect whether "tainted" output is given to a sensitive "sink" without being properly sanitized. See, e.g., Omer Tripp et al., "TAJ: Effective Taint Analysis of Web Applications" (PLDI 2009) ( http://www.cs.tau.ac.il/~omertrip/…
You're making the same mistake made by people who mistake good static type systems and type inference. Yes, it would be nice to infer the correct escaping function; but forcing people to escape somehow would be sufficient.
Re: Break Google
#49When you search for "${", the page is missing 26 lines of minified JavaScript (lines 9-35 of a non-broken page, at least for me), almost certainly because of a templating bug. These lines, among other things, are responsible for adding the top toolbar to the page. (The missing JS is here: http://pastebin.com/B9cy3T2c )
Can you tell us what tools you used to find all this info and to un-minify their js? thanks!
I did a diff of the source code for a SERP for "${" and a SERP for "$$", ignored any lines that were the same except for s/${/$$/, and then un-minified with http://jsbeautifier.org/
Re: Break Google
#50Earlier quoted context omitted.
Django does this.
How exactly? Due to django's "we want the templating system be general, to be usable for stuff other than html", it can't provide support for such 'guarantee that the output is well formed / valid / has no injection attack entry points' features.
> How exactly?
Everything is escaped by default, and you have to explicitly request for your content to be unescaped.