Changes for page Homoiconicity

Summary

• Page properties (1 modified, 0 added, 0 removed)
• Attachments (0 modified, 1 added, 0 removed)
  • svg-opera-small.png

Details

Page properties

Content

...	...	@@ -10,7 +10,6 @@
10	10
11	11
12	12
13		-
14	14	== Triggering embedded code ==
15	15
16	16	In some contexts (like browsers), XSLT code execution can be triggered while a XML document is parsed, via a xsl:stylesheet tag. The executed XSLT code can be stored on the Internet or in the XML document itself (homoiconicity + self-reference trick). A [[blog post>>http://scarybeastsecurity.blogspot.com/2011/01/harmless-svg-xslt-curiousity.html||rel="__blank"]] by Chris Evans describes a pseudo SVG file triggering a simple RAM DoS . But we can do better ;-)
...	...	@@ -24,6 +24,8 @@
24	24	* fingerprint the underlying XSLT engine
25	25	* draw a circle (red if Webkit, green, otherwise)
26	26
	26	+[[image:svg-webkit-small.png||style="float: right"]]
	27	+
27	27	== Evil SVG images ==
28	28
29	29	Exploitcolor depends of the OS, ...) and exploit a specific vulnerability. This was demonstrated with[[CVE-2011-1774>>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1774||rel="__blank" title="CVE-2011-1774"]] and a Webkit exploit tested on Windows, Linux, iOS and webOS.
...	...	@@ -38,5 +38,3 @@
38	38	The process is the following :
39	39
40	40	* The source XML file (do not
41		-
42		-

svg-opera-small.png

Author

...	...	@@ -1,0 +1,1 @@
	1	+xwiki:XWiki.NicolasGregoire

Size

...	...	@@ -1,0 +1,1 @@
	1	+13.7 KB

Content