Re: [Evolution-hackers] Security Bug in HTML

[Not Zed <notzed ximian com>]

so how is that really any different from doing:

<a href=http://bar.untrusted>http://foo.trusted</a>

?

On Sun, 2004-01-11 at 16:47 +0100, Iñigo Serna wrote:
> Hi,
> 
> I'm explained myself badly: the wrong url is shown in email body.
> 
> In IE bug, bad url were shown both in location and status bar.
> 
> Here the problem is that gtkhtml widget is showing "http://url1/path";
> instead of "http://url1 %01   %01@url2/path", i.e., a user would see
> what he thinks a trust web site but if he clicks web browser will go to
> the evil site.
> 
> Linux browser will show the whole url, so user will be warned, after
> all.
> 
> Evolution 1.4.5, GtkHTML 3.0.9
> 
> Best regards,
> Iñigo
> 
> 
> El dom, 11-01-2004 a las 16:08, Jeffrey Stedfast escribió:
> > btw, if I recall correctly, the problem in IE was different - where
> > Evolution simply doesn't show the target url in the status bar, IE
> > showed the wrong target link in the status bar... in that it showed what
> > you saw in the rendered version of the html rather than the actual value
> > in the href tag or something to that effect.
> > 
> > Jeff
> > 
> > On Sun, 2004-01-11 at 09:58, Jeffrey Stedfast wrote:
> > > not a problem in 1.5, we now show the target url in the status bar when
> > > the mouse hovers over a link.
> > > 
> > > Jeff
> > > 
> > > On Sun, 2004-01-11 at 06:30, Iñigo Serna wrote:
> > > > Hi all,
> > > > 
> > > > do you remember last security bug in Internet Explorer?
> > > > 
> > > > urls like "http://url1 %01   %01@url2/path" are shown as url1 while link
> > > > is relative to url2 site.
> > > > 
> > > > The attached message shows same bug in my Evolution-1.4.5 +
> > > > GtkHTML-3.0.9.
> > > > 
> > > > Is it solved or must I open a bugzilla entry?
> > > > 
> > > > Best regards,
> > > > Iñigo Serna
> > > 
> > > _______________________________________________
> > > evolution-hackers maillist  -  evolution-hackers lists ximian com
> > > http://lists.ximian.com/mailman/listinfo/evolution-hackers
> > > 
> > 
> > _______________________________________________
> > evolution-hackers maillist  -  evolution-hackers lists ximian com
> > http://lists.ximian.com/mailman/listinfo/evolution-hackers
> -- 
> Iñigo Serna <inigoserna terra es>
> Katxijasotzaileak