[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <4627b6cd-8ea9-423e-aa6f-404162307970@foolishgames.com>
Date: Tue, 24 Jun 2025 16:48:53 -0400
From: Lucas Holt <luke@...lishgames.com>
To: oss-security@...ts.openwall.com
Subject: Re: xdg-open bypassing SameSite=Strict
On 6/24/25 4:22 PM, Gabriel Corona wrote:
> As was said by Solar Designer, if a "safe" version is needed,
> it should probably be the default when going through URI scheme
> registrations. This is because, as you said, this kind of issue
> lies in the interaction between several components (URI sources,
> URI sinks and URI go-betweens such as xdg-open) and it would
> certainly be possible to find a way to bypass the behavior
> otherwise.
>
I would think that all browsers should implement the safe behavior or
URL handler registrations and allow the user (or enterprise) to adjust
the policy within settings. This would limit the issue for the vast
majority of users, but allow folks to turn on the old behavior until
applications can be fixed. I suspect this could break some auth flows
that rely on handlers right now within many apps. (game launchers,
enterprise tools, etc)
I don't think the right place to handle this is xdg-open. Essentially,
browsers are trusting unsafe input as is.
--
Lucas Holt
Luke@...lishGames.com
________________________________________________________
MidnightBSD.org (Free OS)
JustJournal.com (Free blogging)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
